Secure limited components for use with medical devices

ABSTRACT

In some examples, an ambulatory medical device is provided. The ambulatory medical device includes at least one sensor configured to acquire data descriptive of the patient, one or more processors in communication with the at least one sensor, a patient care component executable by the one or more processors, and a limited functionality component executable by the one or more processors. The patient care component is configured to perform one or more primary operations of the ambulatory medical device at least in part by accessing the data descriptive of the patient. The limited functionality component is configured to exchange information with a communication device and to not affect the one or more primary operations of the ambulatory medical device.

RELATED APPLICATIONS

This application claims the benefit under 35 U.S.C. § 120 as acontinuation of U.S. patent application Ser. No. 16/277,050, titled“SECURE LIMITED COMPONENTS FOR USE WITH MEDICAL DEVICES,” filed on Feb.15, 2019, which claims priority under 35 U.S.C. § 121 as a division ofU.S. patent application Ser. No. 15/233,245, titled “SECURE LIMITEDCOMPONENTS FOR USE WITH MEDICAL DEVICES,” filed on Aug. 10, 2016, nowU.S. Pat. No. 10,252,070, which claims priority under 35 U.S.C. § 119(e)to U.S. Provisional Application Ser. No. 62/215,558, titled “SECURELIMITED COMPONENTS FOR USE WITH MEDICAL DEVICES,” filed Sep. 8, 2015,each of which are hereby incorporated herein by reference in theirentireties for all purposes.

BACKGROUND

This disclosure relates to secure limited components for use withmedical devices and systems and techniques for communicating withmedical devices through such components.

There are a wide variety of electronic and mechanical devices formonitoring and treating patients' medical conditions. In some examples,depending on the underlying medical condition being monitored ortreated, medical devices such as cardiac pacemakers or defibrillatorsmay be surgically implanted or connected externally to the patient. Insome cases, physicians may use medical devices alone or in combinationwith drug therapies to treat patient medical conditions.

One of the most deadly cardiac arrhythmias is ventricular fibrillation,which occurs when normal, regular electrical impulses are replaced byirregular and rapid impulses, causing the heart muscle to stop normalcontractions and to begin to quiver. Normal blood flow ceases, and organdamage or death can result in minutes if normal heart contractions arenot restored. Because the victim has no perceptible warning of theimpending fibrillation, death often occurs before the necessary medicalassistance can arrive. Other cardiac arrhythmias can include excessivelyslow heart rates known as bradycardia.

Implantable or external pacemakers and defibrillators (such as automatedexternal defibrillators or AEDs) have significantly improved the abilityto treat these otherwise life-threatening conditions. Such devicesoperate by applying corrective electrical pulses directly to thepatient's heart. For example, bradycardia can be corrected through theuse of an implanted or external pacemaker device. Ventricularfibrillation can be treated by an implanted or external defibrillator.

Some medical devices operate by continuously or substantiallycontinuously monitoring the patient's heart through one or more sensingelectrodes for treatable arrhythmias and, when such is detected, thedevice applies corrective electrical pulses directly to the heartthrough one or more therapy electrodes.

SUMMARY

In some examples, an ambulatory medical device is provided. Theambulatory medical device comprises at least one sensor configured toacquire data descriptive of the patient, one or more processors incommunication with the at least one sensor, a patient care componentexecutable by the one or more processors, and a limited functionalitycomponent executable by the one or more processors. The patient carecomponent is configured to perform one or more primary operations of theambulatory medical device at least in part by accessing the datadescriptive of the patient. The limited functionality component isconfigured to exchange information with a communication device and tonot affect the one or more primary operations of the ambulatory medicaldevice.

In the ambulatory medical device, the information exchanged with thecommunication device may comprise one or more commands received from thecommunication device, and the limited functionality component may beconfigured to execute the one or more commands. The limitedfunctionality component may be configured to not affect the one or moreprimary operations of the ambulatory medical device by being configuredto be unable to affect the one or more primary operations of theambulatory medical device. The one or more primary operations of theambulatory medical device may comprise one or more critical operationsof the ambulatory medical device. The one or more critical operationsmay comprise at least one of monitoring a patient for a predeterminedpatient condition, providing information relating to the predeterminedpatient condition to a person, receiving user input relating to thepredetermined patient condition from the person, determining a therapyfor the patient on detecting the predetermined patient condition, andproviding the therapy to the patient based on the predetermined patientcondition.

In the ambulatory medical device, the at least one sensor may comprise asensing electrode, the patient care component is configured to monitor acardiac function of the patient based on the data acquired by thesensing electrode, and the one or more primary operations of theambulatory medical device comprise operations relating to detecting acardiac condition of the patient based on the cardiac function of thepatient.

The ambulatory medical device may further comprise at least onetreatment electrode configured to provide a defibrillating shock. The atleast one sensor may comprise a sensing electrode. The patient carecomponent may be configured to monitor a cardiac function of the patientbased on data acquired by the sensing electrode. The one or more primaryoperations of the ambulatory medical device may comprise operationsrelating to treating a cardiac condition of the patient via the at leastone treatment electrode upon detecting the cardiac condition based onthe cardiac function of the patient.

In the ambulatory medical device, the sensor may comprise at least oneof a tissue fluid sensor, a heart sounds sensor, a lung sounds sensor,an accelerometer, and a pulse oximeter.

The ambulatory medical device may further comprise a memory. The patientcare component may be configured to manipulate primary data stored inthe memory and manipulate secondary data stored in the memory. Thelimited functionality component may be configured to not affect the oneor more primary operations of the ambulatory medical device at least inpart by being configured to manipulate the secondary data but be limitedto read-only access of the primary data.

In the ambulatory medical device, the memory may be configured toprovide a primary data store and a secondary data store. The patientcare component may be configured to manipulate primary data stored inthe primary data store and manipulate secondary data stored in thesecondary data store. The limited functionality component may beconfigured to not affect the one or more primary operations of theambulatory medical device at least in part by being configured tomanipulate data stored in the secondary data store but be limited toread-only access of data stored in the primary data store.

In the ambulatory medical device, the patient care component may beexecutable by a first processing thread of the one or more processorsand the limited functionality component may be executable by a secondprocessing thread of the one or more processors.

In the ambulatory medical device, the memory may be configured toprovide a primary data store and a secondary data store. The one or moreprocessors may comprise a primary processor and a secondary processor.The patient care component may be executable by the primary processor.The limited functionality component may be executable by the secondaryprocessor. The patient care component may be configured to manipulateprimary data stored in the primary data store and manipulate secondarydata stored in the secondary data store. The limited functionalitycomponent may be is configured to not affect the one or more primaryoperations of the ambulatory medical device at least in part by beingconfigured to manipulate data stored in the secondary data store but belimited to read-only access of data stored in the primary data store.The primary processor and the secondary processor may be processingcores of a single physical processor.

In the ambulatory medical device, the limited functionality componentmay be configured to not affect the one or more primary operations ofthe ambulatory medical device at least in part by being configured tolimit execution of one or more commands received from the communicationdevice. The limited functionality component may be configured to limitexecution of the one or more commands to those one or more commands thatdo not affect the one or more primary operations of the ambulatorymedical device. The limited functionality component may be configured toeither limit or shut down execution of the one or more commands based atleast on one of a threshold number of commands per time period, athreshold number of active streams, a threshold percentage utilizationof the at least one processor, a threshold percentage memory consumed,and a threshold number of threads. The limited functionality componentmay be configured to limit execution of the one or more commands to athreshold based on a type of the at least one processor.

The ambulatory medical device may further comprise a battery forproviding battery power to the ambulatory medical device. The limitedfunctionality component may be configured to either limit or shut downexecution of the one or more commands upon detecting that an amount ofbattery power transgresses a threshold value.

In the ambulatory medical device, the limited functionality componentmay be configured to authenticate the information received from thecommunication device as originating from one or more previouslyidentified communication devices. The limited functionality componentmay be configured to authenticate the information received from thecommunication device using at least one of password authentication andcertificate-based authentication.

The ambulatory medical device may further comprise a user interfacecomponent. The limited functionality component may be configured to sendone or more interface commands to the user interface component. The oneor more interface commands may be configured to initiate output of apredefined message via the user interface component. The limitedfunctionality component may be configured to execute an interfacecommand configured to modify a message to be output by the userinterface component and send one or more interface commands to the userinterface component, the one or more interface commands comprising atleast one interface command configured to initiate output of themodified message. The interface command may be configured to not affectthe one or more primary operations of the ambulatory medical device atleast in part by being configured to determine whether the message canbe modified based on identifying whether the message is flagged asrestricted from modification by at least the limited functionalitycomponent. The limited functionality component may be configured to sendone or more interface commands to the user interface component based onthe one or more commands received from the communication device.

In the ambulatory medical device, the limited functionality componentmay be an application program interface implemented using at least oneof a representational state transfer, JavaScript object notation,extensible markup language, and encrypted uniform resource locatorparameters. The limited functionality component may be accessible by atransmission control protocol socket.

In the ambulatory medical device, at least one command of the one ormore commands may be further configured to initiate transmission ofinformation from the ambulatory medical device to the communicationdevice. The at least one command may be configured to initiatetransmission of information from the ambulatory medical device to thecommunication device (a) in response to a predetermined condition, (b)substantially in real time, (c) during an occurrence of thepredetermined condition, (d) in response to user input, (e) in responseto a predetermined triggering event, (f) continuously over a period oftime, (g) substantially continuously over a period of time, (h) duringperiodic time intervals, or (i) during aperiodic time intervals. Theinformation may be descriptive of at least one of a cardiac function ofthe patient and a status of the ambulatory medical device. Theinformation may be descriptive of the cardiac function of the patientand may comprise electrocardiogram data. The information may bedescriptive of the status of the ambulatory medical device and maycomprise electrode fall-off status. The information may comprise atleast one of electrocardiogram data, heart sound data, patient locationdata, ambulatory medical device status data, patient name, andcompliance data.

The ambulatory medical device may comprise a wearable cardiac monitor.The ambulatory medical device may comprise a cardiac monitor configuredto either continuous or substantially continuous monitor a patient viathe at least one sensor and provide a treatment to the patient via oneor more therapy electrodes. The ambulatory medical device may comprise acardiac monitor configured to provide a treatment to the patient via oneor more adhesive electrodes.

According to another example, a system is provided. The system comprisesa communication device in communication with an external sensor and anambulatory medical device. The ambulatory medical device comprises atleast one sensor configured to acquire data descriptive of the patient,one or more processors in communication with the at least one sensor, apatient care component executable by the one or more processors, and alimited functionality component executable by the one or moreprocessors. The patient care component may be configured to perform oneor more primary operations of the ambulatory medical device at least inpart by accessing the data descriptive of the patient. The limitedfunctionality component may be configured to execute commands receivedfrom the communication device, the limited functionality componentconfigured to not affect the one or more primary operations of theambulatory medical device.

In the system, the communication device may comprise at least one ofanother medical device distinct from the ambulatory medical device, awearable device distinct from the ambulatory medical device, a chargerof the ambulatory medical device, a base station of the ambulatorymedical device, and a smart phone. The wearable device may comprise atleast one of a watch, anklet, necklace, belt buckle, and glasses. Thecommunication device may be in data communication with the ambulatorymedical device by either a wired or wireless network connection. Theambulatory medical device may comprises a user interface component. Thecommands may comprise at least one command configured to receiveinformation descriptive of the communication device and request that theuser interface component display the information. The information maydescribe at least one of an image stored on the communication device, asignal strength of a network connection between the ambulatory medicaldevice and the communication device, and an amount of power remaining ina battery comprised within the communication device. The communicationdevice may be comprised within the ambulatory medical device.

In the system, the communication device may be further configured togenerate a first request to execute a first command to configure athreshold value for a patient parameter monitored by the ambulatorymedical device and transmit the first request to the limitedfunctionality component. The limited functionality component may befurther configured to receive the first request; parse the first requestto identify the first command and the threshold value; execute the firstcommand; monitor, in response to executing the first command, thepatient parameter to determine whether the patient parametertransgresses the threshold value; and transmit a notification to arecipient device where the patient parameter transgresses the thresholdvalue. The patient parameter may be time elapsed since the patient lastcomplied with a prescribed treatment schedule and the threshold valuemay be a prescribed time interval within the prescribed treatmentschedule. The prescribed treatment schedule may require a rehabilitationsession. The prescribed treatment schedule may require takingmedication.

In the system, the ambulatory medical device may comprise a userinterface component, and the limited functionality component may befurther configured to prompt for input indicating whether the patientcomplied with the prescribed treatment schedule. The patient parametermay be heartbeats per minute (bps) and the threshold value may be 180bps. The communication device may be further configured to generate asecond request to execute a second command to configure an identifier ofthe recipient device to be an address, and transmit the second requestto the limited functionality component. The limited functionalitycomponent may be further configured to receive the second request; parsethe second request to identify the second command and the address;execute the command; and store, during execution of the second command,the address as the identifier of the recipient device, therebyconfiguring the limited functionality component to notify the recipientdevice at the address where the patient's bps transgresses 180 bps. Therecipient device may be the ambulatory medical device. The recipientdevice may be the communication device.

According to another example, a communication device is provided. Thecommunication device comprises memory, at least one processor in datacommunication with the memory, and a medical device interface componentexecutable by the at least one processor. The medical device interfacecomponent is configured to communicate with an ambulatory medicaldevice, the communications comprising commands configured to not affectone or more primary operations of the ambulatory medical device. Thecommunication device may be configured to store medical device datareceived from the ambulatory medical device in a local storage on thecommunication device when the communication device is unable to connectto a remote server. The communication device may be configured totransmit the stored medical data to the remote server when a connectionwith the remote server is established.

According to another example, an ambulatory medical device configured tocare for a patient is provided. The ambulatory medical device comprisesmemory configured to provide a primary data store and a secondary datastore; at least one sensing electrode configured to acquireelectrocardiogram data descriptive of the patient's cardiac function; atleast one treatment electrode configured to provide a defibrillatingshock; one or more processors coupled to the memory, the at least onesensor, and the at least one treatment electrode, the one or moreprocessors comprising a primary processor and a secondary processor; apatient care component executable by the primary processor andconfigured to perform one or more primary operations of the ambulatorymedical device at least in part by being configured to access the datadescriptive of the patient: manipulate primary data stored in theprimary data store; and manipulate secondary data stored in thesecondary data store; and a limited functionality component isexecutable by the secondary processor and configured to not affect theone or more primary operations of the ambulatory medical device at leastin part by being configured to manipulate data stored in the secondarydata store but be limited to read-only access of data stored in theprimary data store.

Implementations can include one or more of the following advantages.

In some implementations, a medical device includes a limitedfunctionality component that provides, to a communication device,limited access to information processed by the medical device. Thislimited functionality component is designed to provide access withoutaffecting any primary operations performed by the medical device. Insome examples, the limited functionality component provides access tomedical device information by receiving commands from the communicationdevice relating to the medical device information, executing thecommands, and issuing responses to the communication device.

In some examples, the limited functionality component protects theprimary operations of the medical device by actively monitoringcomputing resources utilized by execution of the commands and adjustingthe computing resources available for command execution. The limitedfunctionality component may also protect the primary operations bydirectly limiting the number and/or type of commands executed. In someexamples, the limited functionality component avoids impact to theprimary operations by executing through computing resources that areisolated from computing resources used to execute primary operations.This isolation may be physical or virtual and may involve anycombination of data storage resources, processing resources, and powerresources.

Due to the implementation of these techniques, a communication devicecan safely receive a wide array of pre-processed information from themedical device and use this pre-processed information, without furthermodification, to inform the patient or care providers of importantfacts. This communication device may also be in communication with aremote server that is accessible by care providers. In someimplementations described in further detail below, such a communicationdevice can be part of the medical device and communicate with thelimited functionality component of the medical device. Accordingly, themedical device can directly receive commands from a remote server,execute the commands, and directly issue responses to the remote server.

For instance, in one example, a communication device includes a directedrehabilitation application that is configured to, e.g., monitor apatient wearing a cardiac monitor during exercises, and issueinstructions, including instructions to start and stop performing suchexercises at specific times. For example, such exercises can be part ofa rehabilitation program prescribed for the patient. In such an example,the communication device can be configured to transmit commands to thelimited functionality component within the cardiac monitor. Thesecommands can be configured to cause the limited functionality componentto notify the communication device if the patient's heart rate exceeds athreshold value or follows a particular trend or pattern over time.Where the communication device receives such a notification, thecommunication device may issue commands to the limited functionalitycomponent instructing the patient to slow down/ramp down a currentactivity and/or stop. Using the techniques disclosed herein, the cardiacmonitor may provide such functionality without affecting the cardiacmonitor's primary operations.

In another example, an ambulatory medical device is provided. Theambulatory medical device includes at least one sensor configured toacquire signals descriptive of a patient's cardiac function, the atleast one sensor including at least one sensing electrode; at least oneprocessor configured to convert the signals to data descriptive of thepatient's cardiac function; at least one patient care componentexecutable by the at least one processor and configured to perform oneor more primary operations of the ambulatory medical device at least inpart by accessing the data descriptive of the patient, the one or moreprimary operations including monitoring the patient's cardiac function;and a limited functionality component executable by the at least oneprocessor and configured to exchange information with a communicationdevice, the limited functionality component being configured to notaffect the one or more primary operations of the ambulatory medicaldevice.

The information exchanged between the ambulatory medical device and thecommunication device may include one or more commands received from thecommunication device and the limited functionality component may beconfigured to execute the one or more commands. The one or more primaryoperations of the ambulatory medical device may include monitoring thepatient for a predetermined patient condition, providing informationrelating to the predetermined patient condition to a user interface,receiving user input relating to the predetermined patient conditionfrom the user interface, determining a therapy for the patient ondetecting the predetermined patient condition, and providing the therapyto the patient in response to detecting the predetermined patientcondition.

In the ambulatory medical device, the at least one sensor may include asensing electrode; the patient care component may be configured tomonitor a cardiac function of the patient based on the data acquired bythe sensing electrode; and the one or more primary operations of theambulatory medical device may include operations relating to detecting acardiac condition of the patient based on the cardiac function of thepatient. The ambulatory medical device may further include at least onetreatment electrode configured to provide a defibrillating shock,wherein the one or more primary operations of the ambulatory medicaldevice comprise operations relating to treating a cardiac condition ofthe patient via the at least one treatment electrode upon detecting thecardiac condition.

The ambulatory medical device may further include a memory. The at leastone patient care component may be configured to manipulate primary datastored in the memory; and manipulate secondary data stored in thememory. The limited functionality component may be configured to notaffect the one or more primary operations of the ambulatory medicaldevice at least in part by being configured to manipulate the secondarydata but be limited to read-only access of the primary data. The memorymay be configured to provide a primary data store and a secondary datastore. The at least one patient care component may be configured tomanipulate primary data stored in the primary data store and manipulatesecondary data stored in the secondary data store. The limitedfunctionality component may be configured to not affect the one or moreprimary operations of the ambulatory medical device at least in part bybeing configured to manipulate data stored in the secondary data storebut be limited to read-only access of data stored in the primary datastore.

In the ambulatory medical device, the at least one processor may beconfigured to execute the at least one patient care component via afirst processing thread and to execute the limited functionalitycomponent via a second processing thread. The memory in the ambulatorymedical device may be configured to provide a primary data store and asecondary data store. The at least one processor may include a primaryprocessor and a secondary processor. The at least one patient carecomponent may be executable by the primary processor and may beconfigured to manipulate primary data stored in the primary data storeand manipulate secondary data stored in the secondary data store. Thelimited functionality component may be executable by the secondaryprocessor and may be configured to not affect the one or more primaryoperations of the ambulatory medical device at least in part by beingconfigured to manipulate data stored in the secondary data store but belimited to read-only access of data stored in the primary data store.

In the ambulatory medical device, the limited functionality componentmay be configured to not affect the one or more primary operations ofthe ambulatory medical device at least in part by being configured tolimit execution of one or more commands received from the communicationdevice. The limited functionality component may be configured to limitexecution of the one or more commands to those one or more commands thatdo not affect the one or more primary operations of the ambulatorymedical device. The limited functionality component may be configured toeither limit or shut down execution of the one or more commands based atleast on one of a threshold number of commands per time period, athreshold number of commands based on a type of the at least oneprocessor, a threshold number of active streams, a threshold percentageutilization of the at least one processor, a threshold percentage memoryconsumed, and a threshold number of threads.

The ambulatory medical device may further include a battery forproviding battery power to the ambulatory medical device. The limitedfunctionality component may be configured to either limit or shut downexecution of the one or more commands upon detecting that an amount ofbattery power transgresses a threshold value. The limited functionalitycomponent may be configured to authenticate the information receivedfrom the communication device as originating from one or more previouslyidentified communication devices. The limited functionality componentmay be configured to authenticate the information received from thecommunication device using at least one of password authentication andcertificate-based authentication.

The ambulatory medical device may further include a user interfacecomponent. The limited functionality component may be configured to sendone or more interface commands to the user interface component. The oneor more interface commands may be configured to initiate output of oneor more messages via the user interface component. The one or moremessages may be predefined within the ambulatory medical device. Thelimited functionality component may be configured to execute aninterface command configured to modify a message to be output by theuser interface component and to send one or more interface commands tothe user interface component, the one or more interface commandscomprising at least one interface command configured to initiate outputof the message. The interface command may be configured to not affectthe one or more primary operations of the ambulatory medical device atleast in part by being configured to determine whether the message canbe modified based on identifying whether the message is flagged asrestricted from modification. The limited functionality component may beconfigured to send one or more interface commands to the user interfacecomponent based on the one or more commands received from thecommunication device.

In the ambulatory medical device, the at least one sensor may include atleast one of a tissue fluid sensor, a heart sounds sensor, a lung soundssensor, an accelerometer, and a pulse oximeter. The limitedfunctionality component may include an application program interfaceimplemented using at least one of a representational state transfer,JavaScript object notation, extensible markup language, transmissioncontrol protocol socket, and encrypted uniform resource locatorparameters. In the ambulatory medical device, the at least one commandof the one or more commands may be further configured to initiatetransmission of information from the ambulatory medical device to thecommunication device. The at least one command may be configured toinitiate transmission of the information from the ambulatory medicaldevice to the communication device (a) in response to a predeterminedcondition, (b) substantially in real time, (c) during an occurrence ofthe predetermined condition, (d) in response to user input, (e) inresponse to a predetermined triggering event, (f) continuously over aperiod of time, (g) substantially continuously over a period of time,(h) during periodic time intervals, or (i) during aperiodic timeintervals. The information may be descriptive of at least one of thepatient's cardiac function and a status of the ambulatory medicaldevice. The information may include at least one of electrocardiogramdata, heart sound data, patient location data, ambulatory medical devicestatus data, patient name, electrode fall-off status, and compliancedata. The ambulatory medical device may include a cardiac monitorconfigured to either continuous or substantially continuous monitor apatient via the at least one sensor and provide a treatment to thepatient via one or more therapy electrodes. The ambulatory medicaldevice may include a cardiac monitor configured to provide a treatmentto the patient via one or more adhesive electrodes.

In another example, a communication device is provided. Thecommunication device is configured to interoperate with a wearabledefibrillator. The communication device includes a first wirelessinterface configured to communicate with the wearable defibrillator; asecond wireless interface configured to communicate with a remotecomputer; and at least one processor coupled to the first wirelessinterface and the second wireless interface and configure to exclusivelyexecute a hotspot component upon powering up, the hotspot componentbeing configured to automatically establish a first secure connection tothe wearable defibrillator via the first wireless interface, to receivecardiac information regarding a patient from the wearable defibrillatorvia the first connection, to automatically establish a second connectionto the remote computer via the second wireless interface, and totransmit the cardiac information regarding the patient to the remotecomputer via the second connection, the cardiac information comprisingat least one of physiological parameters of the patient and informationregarding compliance by the patient to a prescribed treatment schedule.The communication device may be housed within the wearable medicaldevice or a base station. The hotspot component may be configured tocalculate a signal strength of the first connection and to transmitinformation regarding the signal strength to the remote computer via thesecond connection.

In another example, communication device is provided. The communicationdevice includes a user interface; a medical device interface configuredto communicate with a medical device; and at least one processor coupledto the user interface and the medical device interface and configure totransmit, via the medical device interface, at least one command tomonitor a patient parameter; to receive, via the interface, one or morevalues of the patient parameter; to analyze the one or more values; andto display, via the user interface, information descriptive of the oneor more values.

In the communication device, the patient parameter may include patientheart rate and the information descriptive of the one or more values mayinclude a heart rate trend over a period to time. The communicationdevice may further include a network interface configured to communicatewith a remote computer. The at least one processor may be configured totransmit the one or more values to the remote computer via the networkinterface. The at least one processor may be configured to receive, fromthe remote computer via the network interface, a command to display aninstruction to the patient and to display the instruction to the patientvia the user interface.

In another example, a system is provided. The system includes acommunication device in communication with an external sensor and anambulatory medical device. The ambulatory medical device includes atleast one sensor configured to acquire data descriptive of the patient;one or more processors in communication with the at least one sensor; apatient care component executable by the one or more processors andconfigured to perform one or more primary operations of the ambulatorymedical device at least in part by accessing the data descriptive of thepatient; and a limited functionality component executable by the one ormore processors and configured to execute commands received from thecommunication device, the limited functionality component configured tonot affect the one or more primary operations of the ambulatory medicaldevice.

In the system, the communication device may include at least one ofanother medical device distinct from the ambulatory medical device, awearable device distinct from the ambulatory medical device, a chargerof the ambulatory medical device, a base station of the ambulatorymedical device, and a smart phone, wherein the wearable device comprisesat least one of a watch, anklet, necklace, belt buckle, and glasses. Theambulatory medical device may include a user interface component and thecommands may include at least one command configured to receiveinformation descriptive of the communication device and request that theuser interface component display the information. The information maydescribe at least one of an image stored on the communication device, asignal strength of a network connection between the ambulatory medicaldevice and the communication device, and an amount of power remaining ina battery comprised within the communication device. The communicationdevice may be included within the ambulatory medical device.

In the system, the communication device may be further configured togenerate a request to execute a command to configure a threshold valuefor a patient parameter monitored by the ambulatory medical device andto transmit the request to the limited functionality component. Thelimited functionality component may be further configured to receive therequest; parse the request to identify the command and the thresholdvalue; execute the command; monitor, in response to executing thecommand, the patient parameter to determine whether the patientparameter transgresses the threshold value; and transmit a notificationto a recipient device where the patient parameter transgresses thethreshold value. The patient parameter may include heart beats perminute (bpm) or time elapsed since the patient last complied with aprescribed treatment schedule. The threshold value may include of 180bpm or a prescribed time interval within the prescribed treatmentschedule. The prescribed treatment schedule may require at least one ofa rehabilitation session and taking medication.

Still other aspects, examples and advantages of these aspects andexamples, are discussed in detail below. Moreover, it is to beunderstood that both the foregoing information and the followingdetailed description are merely illustrative examples of various aspectsand features, and are intended to provide an overview or framework forunderstanding the nature and character of the claimed aspects andexamples. Any example or feature disclosed herein may be combined withany other example or feature. References to different examples are notnecessarily mutually exclusive and are intended to indicate that aparticular feature, structure, or characteristic described in connectionwith the example may be included in at least one example. Theappearances of such terms herein are not necessarily all referring tothe same example.

DESCRIPTION OF DRAWINGS

Various aspects of at least one example are discussed below withreference to the accompanying figures, which are not intended to bedrawn to scale. The figures are included to provide an illustration anda further understanding of the various aspects and examples, and areincorporated in and constitute a part of this specification, but are notintended as a definition of the limits of any particular example. Thedrawings, together with the remainder of the specification, serve toexplain principles and operations of the described and claimed aspectsand examples. In the figures, each identical or nearly identicalcomponent that is illustrated in various figures is represented by alike numeral. For purposes of clarity, not every component may belabeled in every figure. In the drawings:

FIG. 1 is a schematic diagram of one example of a medical device.

FIGS. 2A and 2B are schematic diagrams of a first side and a second sideof one example of a medical device controller.

FIG. 3 is a block diagram of the example of the medical devicecontroller illustrated in FIGS. 2A and 2B.

FIG. 4 is a schematic diagram of an example system including a medicaldevice and a base station.

FIG. 5 is a schematic diagram of another example of a medical device.

FIG. 6 is a schematic diagram of another example of a medical device.

FIG. 7 is a schematic diagram of another example of a medical devicecontroller.

FIG. 8 is a flow diagram illustrating two examples of interfaceprocesses.

FIG. 9 is a flow diagram illustrating one example of a commandprocessing process.

FIG. 10 is a block diagram of one example of a notification system.

FIG. 11 is a block diagram of another example of a notification system.

FIG. 12 is a block diagram of another example of a notification system.

DETAILED DESCRIPTION

Systems and techniques as disclosed herein can be configured tofacilitate secure and limited interactions with medical devices. Themedical devices as disclosed herein may monitor a person (e.g., apatient) and, in some implementations, provide treatment to the personbased on the monitoring. For example, the medical device can monitor oneor more physiological parameters of the person. For instance, themedical device can be configured to monitor data digitized from one ormore physiological signals of a patient (e.g., electrocardiograph (ECG)data), heart beats, respiration, breath sounds, tissue fluids, lungfluids, lung sounds, chest movements, and/or cardiopulmonary anomaliesand determine whether the detected anomalies impair cardiac or pulmonaryfunction. In various implementations, the medical device can beconfigured to monitor other patient parameters including but not limitedto blood pressure, glucose levels, weight, blood oxygen, etc.

For example, medical devices as disclosed herein can be configured todetermine whether the patient may be experiencing a cardiac condition.The medical devices can include a plurality of sensing electrodes thatare disposed at one or more locations of the patient's body andconfigured to sense or monitor the cardiac signals of the patient. Insome implementations, the medical device can be configured to monitor,in addition to cardiac signals, heart sounds, lung sounds, respiration,chest movements, and/or other patient body movement information. Forexample, such devices can be used as cardiac monitors in certain cardiacmonitoring applications, such as holter monitoring, mobile cardiactelemetry (MCT) and/or continuous event monitoring (CEM) applications.

In some implementations, a medical device as disclosed herein can beconfigured to determine an appropriate treatment for the patient basedon the sensed patient signals (e.g., cardiac signals, heart sounds, lungsounds, or other sensed information) and cause one or more therapeuticshocks (e.g., defibrillating and/or pacing shocks) to be delivered tothe body of the patient as described in further detail below.Accordingly, the medical device can include a plurality of therapyelectrodes that are disposed at one or more locations of the patient'sbody and configured to deliver the therapeutic shocks.

A medical device as described herein can be configured to monitor apatient for a cardiac arrhythmia condition such as bradycardia,ventricular tachycardia (VT) or ventricular fibrillation (VF). Inaddition, while the detection methods and systems described hereinafterare disclosed as detecting VT and VF, this is not to be construed aslimiting the examples disclosed herein as other arrhythmias, such as,but not limited to, atrial arrhythmias including premature atrialcontractions (PACs), multifocal atrial tachycardia, atrial flutter, andatrial fibrillation, supraventricular tachycardia (SVT), junctionalarrhythmias, tachycardia, junctional rhythm, junctional tachycardia,premature junctional contraction, and ventricular arrhythmias includingpremature ventricular contractions (PVCs) and acceleratedidioventricular rhythm, may also be detected. In the case of treatmentdevices, such as, pacing and/or defibrillating devices, if an arrhythmiacondition is detected, the device can automatically provide a pacing ordefibrillation pulse or shock to treat the condition.

In some implementations, a medical device includes a limitedfunctionality component that is configured to exchange (e.g., transmitor receive) information with a communication device in a manner thatdoes not affect any primary operation of the medical device. Forexample, such a limited functionality component can be configured to beunable to affect any primary operation of the medical device. Themedical device may be a cardiac monitor that includes a limitedfunctionality component that transmits data descriptive of the cardiacfunction of a patient to a communication device in the form of a smartphone. In this example, the limited functionality component may monitorcomputing resources (e.g., compute or data storage resources) availablefor the primary operations of the medical device and adjust computingresources utilized by limited functionality operations to ensure theprimary operations are not impacted. This adjustment may includerestricting limited functionality operations to a threshold number ofoperations per time period, a threshold number of threads, specificthread priorities, specific types of data operations, specific datastores or a threshold utilization of specific data stores, specificactual or virtual processors or processor types, a threshold utilizationof one or more actual or virtual processors, and the like. In someimplementations, the limited functionality component may be configuredto restrict or shut down its functionality in certain situations. Suchsituations include but are not limited to: when the component consumesresources (e.g., operations per time period, number of threads, datastorage utilization, and the like) that transgresses a predeterminedthreshold, the battery power available in the medical device reaches apredetermined level, or when a critical operation of the device isongoing (e.g., when a treatment protocol is being executed by thedevice).

In some implementations, the information exchanged between the limitedfunctionality component and the communication device includes one ormore commands that the limited functionality component is configured toexecute and one or more responses resulting from command execution. Forexample, the limited functionality component may receive a command tostream cardiac data to the communication device and the communicationdevice may process the stream in response to receipt of the command.

In some implementations, a primary operation of a medical device is anyoperation of the medical device that causes the medical device to besubject to government regulation as of the filing date of the presentdisclosure. For instance, a primary operation of a medical device may beany operation of the medical device that causes the medical device to besubject to Title 21 of the U.S. Code of Federal Regulations Chapter I,Subchapter H, such as Part 814 of the Regulations concerning pre-marketapprovals of medical devices, as of the filing date of the presentdisclosure. In other examples, a primary operation of a medical deviceincludes any operation that affects patient safety and/or deviceefficacy with respect to the prescribed purpose of the medical device.In other examples, a primary operation of a medical device includes anyoperation critical to the prescribed purpose of the medical device. Thusthe primary operation or operations of medical devices vary with thedesigns of the medical devices and the jurisdictions within which themedical devices operate. Examples of critical operations includemonitoring a patient for a predetermined patient condition, providinginformation relating to the predetermined patient condition to a person,receiving user input relating to the predetermined patient conditionfrom the person, determining a therapy for the patient on detecting thepredetermined patient condition, and providing the therapy to thepatient based on the predetermined patient condition. Accordingly insuch examples, the primary operations are executed by one or morepatient care components of a medical device.

In some implementations, as noted above, primary operations can includedevice functions and operations that have the potential to affect thesafety and efficacy of the medical device. In an implementation, suchoperations may relate to ensuring the integrity of one or more criticalcomponents of the medical device, e.g., all or some of the one or morepatient care components. Such primary operations can include self-testsperformed by the device, e.g., to verify the operational integrity ofcritical components of the medical device. For instance, in a cardiactreatment device such as a defibrillator, primary operations can includetests of the energy storage elements and associated circuitry. Adefibrillator may periodically or aperiodically enable a high voltageconverter circuit to charge one or more capacitor banks and take certainmeasurements to verify that the capacitor banks are able to properlycharge up to the required levels.

In some implementations, for increased security, the limitedfunctionality component can be configured to authenticate thecommunication device and determine whether the communication device isauthorized to exchange information with the medical device. For example,the limited functionality component may process logon credentials priorto executing any commands requested by the communication device.

In some implementations, the limited functionality component initiatesdisplay of information received from the communication device on adisplay of the medical device. For example, the limited functionalitycomponent may initiate display of a physician's instructions on atouchscreen housed in the medical device. In some cases, the limitedfunctionality component may initiate display of the remaining batterylife of the communication device (e.g., a smart phone) on a touchscreenhoused in the medical device.

Examples of the methods and systems discussed herein are not limited inapplication to the details of construction and the arrangement ofcomponents set forth in the following description or illustrated in theaccompanying drawings. The methods and systems are capable ofimplementation in other examples and of being practiced or of beingcarried out in various ways. Examples of specific implementations areprovided herein for illustrative purposes only and are not intended tobe limiting. In particular, acts, components, elements and featuresdiscussed in connection with any one or more examples are not intendedto be excluded from a similar role in any other examples.

Also, the phraseology and terminology used herein is for the purpose ofdescription and should not be regarded as limiting. Any references toexamples, components, elements or acts of the systems and methods hereinreferred to in the singular may also embrace examples including aplurality, and any references in plural to any example, component,element or act herein may also embrace examples including only asingularity. References in the singular or plural form are not intendedto limit the presently disclosed systems or methods, their components,acts, or elements. The use herein of “including,” “comprising,”“having,” “containing,” “involving,” and variations thereof is meant toencompass the items listed thereafter and equivalents thereof as well asadditional items. References to “or” may be construed as inclusive sothat any terms described using “or” may indicate any of a single, morethan one, and all of the described terms. In addition, in the event ofinconsistent usages of terms between this document and documentsincorporated herein by reference, the term usage in the incorporatedreferences is supplementary to that of this document; for irreconcilableinconsistencies, the term usage in this document controls.

Example Medical Devices

In some implementations, the systems, components, and/or techniquesdescribed herein can be used in a wide range of medical devices. Forinstance, such medical device can be internal (e.g., implantable),invasive, or external medical devices. For example, external medicaldevices may be in contrasted with internal devices, such as implantablemedical devices. For example, the medical device can be a cardiacmonitoring and/or pacing device or defibrillator, such as an in-facilitycontinuous monitoring defibrillator (e.g., for patients that areconfined to a limited space within a facility, such as, within ahospital environment, to a patient's room) or outpatient wearabledefibrillators. The primary operations of these devices includemonitoring patient cardiac function and, in some cases, treating cardiacarrhythmias, such as VT or VF. In at least some of these devices, thepatient care components include monitoring, detecting, and treatingcomponents, such as the cardiac event detector 326, the sensor interface312, and the therapy delivery interface 302.

In some implementations, an external medical device can be an automatedcardiac monitor or defibrillator that can be used in certain specializedconditions and/or environments such as in combat zones or withinemergency vehicles. The medical device can be configured so that it canbe used immediately (or substantially immediately) in a life-savingemergency. For example, the external medical device can be an automatedexternal defibrillator (AED). Such AEDs are available from ZOLL® MedicalCorporation of Chelmsford, Mass.

In some implementations, the external medical device is an ambulatorydevice (e.g., a device that is capable of and designed for moving withthe patient as the patient goes about his or her daily routine). In someexamples, the external medical device can be configured as a wearabledefibrillator, such as the LifeVest® wearable defibrillator availablefrom ZOLL® Medical Corporation of Chelmsford, Mass.

The devices as described herein may be capable of continuously,substantially continuously, long-term and/or extended use or wear by, orattachment or connection to a patient.

For example, devices as described herein may be capable of being used orworn by, or attached or connected to a patient, without substantialinterruption for a predetermined period of time. In some examples, suchdevices may be capable of being used or worn by, or attached orconnected to a patient for example, up to hours or beyond (e.g., weeks,months, or even years).

In some implementations, such devices may be removed for a period oftime before use, wear, attachment, or connection to the patient isresumed, e.g., to change batteries, to change the garment, and/or totake a shower, without departing from the scope of the examplesdescribed herein.

The devices as described herein may be capable of continuously,substantially continuously, long-term and/or extended monitoring of apatient.

For example, devices as described herein may be capable of providingcardiac monitoring without substantial interruption for a predeterminedperiod of time. In some examples, such devices may be capable ofcontinuously or substantially continuously monitoring a patient forcardiac-related information (e.g., ECG information, including arrhythmiainformation, heart sounds, etc.) and/or non-cardiac information (e.g.,blood oxygen, the patient's temperature, glucose levels, and/or lungsounds), for example, up to hours or beyond (e.g., weeks, months, oreven years).

In some implementations, such devices may be powered down for a periodof time before monitoring is resumed, e.g., to change batteries, tochange the garment, and/or to take a shower, without departing from thescope of the examples described herein.

In some instances, the devices may carry out monitoring in periodic oraperiodic time intervals or times. For example, the monitoring duringintervals or times can be triggered by a user action or another event.For example, one or more durations between the periodic or aperiodicintervals or times can be user-configurable.

In various implementations, the devices may be operated on battery powerfor a duration of the device's use after which the batteries may bereplaced and/or recharged.

In some implementations, the medical device as described herein can be ahospital-based wearable defibrillator and/or pacing device. For example,such a hospital-based device can include a defibrillator and/or pacingdevice configured for continuous or substantially continuous use, wear,connection, attachment, or monitoring to/of a patient in a hospitalenvironment. The hospital-based device can include a plurality oftherapy and sensing electrodes that are attached to the patient's skin.In some examples, the electrodes are disposable adhesive electrodes. Insome implementations, the electrodes are affixed to an electrodeassembly (a patch), which can then be adhesively attached to thepatient's skin. The electrodes can be attached to the patient's skin atparticular locations as prescribed by a trained professional.

In operation, the hospital-based device can include a monitor configuredto operate in a manner that is different from that of the monitor ofwearable defibrillator 100 described with respect to FIG. 1. Asdescribed in more detail herein, an interface, prompts, andcommunication performed by the hospital-based device can be configuredfor and/or directed to a user other than a patient, e.g., a caregiversuch as a nurse or a patient service representative. For example, acaregiver can program the device and/or set the device up for use by thepatient. The interface, prompts, and communication can be directed tothe patient in scenarios such as when a response is required for thedevice to detect whether or not the patient is conscious, which can beused in deciding when to shock the patient, and when a patient is givenan alert to call the caregiver.

In some implementations, the medical device as described herein canconfigured to perform a primary operation of monitoring a patientpresenting with syncope (e.g., by analyzing the patient's cardiacactivity for aberrant patterns that can indicate abnormal physiologicalfunction). In some examples, aberrant patterns may occur prior to,during, or after the onset of syncope symptoms. For example, theshort-term outpatient defibrillator can include a plurality ofelectrodes and/or an electrode assembly (patch) that can be adhesivelyattached to the patient's skin. The patient may replace the electrodesand/or patches as prescribed.

For example, the medical device can include a user interface forinteracting with the medical device. The device can include one or moreinput mechanisms (e.g., buttons) that the patient can interact with inorder to respond to an alert (e.g., a treatment alert or a statusalert). In some examples, the medical device issues a treatment alertbefore providing a treatment shock, and if the patient does not respondto the treatment alert (e.g., by holding down one or more responsebuttons), the device can deliver the treatment shock to restore normalheart rhythm. In some examples, the medical device issues a status alertwhere the device detects that an electrode (e.g. a sensing electrode) isnot properly positioned on the patient's body. This type of status alertmay be referred to herein as a “fall-off” status alert.

Example Wearable Medical Device

FIG. 1 illustrates an example medical device 100 that is wearable by thepatient 102. The wearable medical device 100 includes a plurality ofsensing electrodes 112 that can be disposed at various positions aboutthe patient's body. The sensing electrodes 112 are electrically coupled(coupling not shown in the figure) to a medical device controller 120through a connection pod 130. In some implementations, some of thecomponents of the wearable medical device 100 are affixed to a garment110 that can be worn on the patient's torso. For example, as shown inFIG. 1, the controller 120 can be mounted on a belt worn by the patient.The sensing electrodes 112 and connection pod 130 can be assembled orintegrated into the garment 110 as shown. The sensing electrodes 112 areconfigured to monitor the cardiac function of the patient (e.g., bymonitoring one or more cardiac signals of the patient). While FIG. 1shows three sensing electrodes 112, additional sensing electrodes may beprovided, and the plurality of sensing electrodes 112 may be disposed atvarious locations about the patient's body.

The wearable medical device 100 can also optionally include a pluralityof therapy electrodes 114 that are electrically coupled (coupling notshown in the figure) to the medical device controller 120 through theconnection pod 130. The therapy electrodes 114 are configured to deliverone or more therapeutic defibrillating shocks to the body of the patientif it is determined that such treatment is warranted. The connection pod130 may include electronic circuitry and one or more sensors (e.g., amotion sensor, an accelerometer, etc.) that are configured to monitorpatient activity. In some implementations, the wearable medical device100 may be a monitoring only device that omits the therapy deliverycapabilities and associated components (e.g., the therapy electrodes114). In some implementations, various treatment components may bepackaged into various components that can be attached or removed fromthe wearable medical device 100 as needed.

The controller 120 includes response buttons and a touch screen that thepatient can interact with in order to communicate with the medicaldevice 100. The controller 120 also includes a speaker for communicatinginformation to the patient and/or a bystander. In some examples, whenthe controller 120 determines that the patient is experiencing cardiacarrhythmia, the speaker can issue an audible alarm to alert the patientand bystanders to the patient's medical condition. In some examples, thecontroller 120 can instruct the patient to press and hold one or both ofthe response buttons on the medical device controller 120 to indicatethat the patient is conscious, thereby instructing the medical devicecontroller 120 to withhold the delivery of one or more therapeuticdefibrillating shocks. If the patient does not respond to an instructionfrom the controller 120, the medical device 100 may determine that thepatient is unconscious and proceed with the treatment sequence,culminating in the delivery of one or more defibrillating shocks to thebody of the patient.

FIGS. 2A and 2B illustrate an example of the medical device controller120. The controller 120 may be powered by a rechargeable battery 212.The rechargeable battery 212 may be removable from a housing 206 of themedical device controller 120 to enable a patient and/or caregiver toswap a depleted (or near depleted) battery 212 for a charged battery.The controller 120 includes a user interface such as a touch screen 220that can provide information to the patient, caregiver, and/orbystanders. The patient and/or caregiver can interact with the touchscreen 220 to control the medical device 100. The controller 120 alsoincludes a speaker 204 for communicating information to the patient,caregiver, and/or the bystander. The controller 120 includes one or moreresponse buttons 210. In some examples, when the controller 120determines that the patient is experiencing cardiac arrhythmia, thespeaker 204 can issue an audible alarm to alert the patient andbystanders to the patient's medical condition. In some examples, thecontroller 120 can instruct the patient to press and hold one or both ofthe response buttons 210 to indicate that the patient is conscious,thereby instructing the medical device controller 120 to withhold thedelivery of therapeutic defibrillating shocks. If the patient does notrespond to an instruction from the controller 120, the medical device100 may determine that the patient is unconscious and proceed with thetreatment sequence, culminating in the delivery of one or moredefibrillating shocks to the body of the patient. The medical devicecontroller 120 may further include a port 202 to removably connectsensing devices (e.g., ECG sensing electrodes 112) and/or therapeuticdevices (e.g., therapy electrodes 114) to the medical device controller120.

FIG. 3 shows a schematic of an example of the medical device controller120 of FIGS. 1, 2A, and 2B. The controller 120 includes at least oneprocessor 318, a limited functionality component 330, a sensor interface312, an optional therapy delivery interface 302, data storage 304 (whichmay include patient data storage 316), an optional network interface306, a user interface 308 (e.g., including the touch screen 220 shown inFIG. 2), and a battery 310. The sensor interface 312 may be coupled toany one or combination of sensors to receive information indicative ofpatient parameters. For example, the sensor interface 312 may be coupledto one or more sensing devices including, for example, sensingelectrodes 328. The therapy delivery interface 302 (if included) may becoupled to one or more electrodes that provide therapy to the patientincluding, for example, one or more therapy electrodes 320, pacingelectrodes 322, and/or TENS electrodes 324. The sensor interface 312 andthe therapy delivery interface 302 may implement a variety of couplingand communication techniques for facilitating the exchange of databetween the sensors and/or therapy delivery devices and the controller120.

In some examples, the network interface 306 can facilitate thecommunication of information between the controller 120 and one or moreother devices or entities over a communications network. For example,the network interface 306 may be configured to communicate with a server(e.g., a remote server) where a caregiver can access information relatedto the patient. As discussed in more detail below with reference to FIG.4, the network interface 306 may facilitate communication between themedical device controller 120 and a base station associated (e.g.,paired) with the medical device controller.

In some examples, the medical device controller includes a cardiac eventdetector 326 to monitor the cardiac activity of the patient and identifycardiac events experienced by the patient based on received cardiacsignals. The cardiac event detector 326 may be configured to execute oneor more heartbeat detection processes and/or arrhythmia detectionprocesses. In some examples, the cardiac event detector 326 can accesspatient templates (e.g., which may be stored in the data storage 304 aspatient data 316) that can assist the cardiac event detector 326 inidentifying cardiac events experienced by the particular patient.

In some implementations, the processor 318 includes one or moreprocessors that each can perform a series of instructions that result inmanipulated data and/or control the operation of the other components ofthe controller 120. In some examples, the limited functionalitycomponent 330 is implemented as a software component that is stored inthe data storage 304 and executed by the at least one processor 318 toexpose, for example, a limited functionality interface to one or morecommunication devices (e.g., the communication devices described belowwith reference to FIGS. 10 and 11).

In some examples, the limited functionality component 330 is configuredto implement a limited functionality interface through which thecontroller 120 receives, processes, and responds to commands definedwithin a limited functionality command set. Some additional examples ofthe controller 120 configured to execute the limited functionalitycomponent 330 in isolation from other components are described furtherbelow with reference to FIG. 7. Some examples of processes executed bythe limited functionality component 330 are described further below withreference to FIGS. 8 and 9.

The controller 120 may be well-suited for a range of different cardiacmonitoring and/or treatment devices and some additional examples ofmedical devices that incorporate the controller 120 are describedfurther below.

In various implementations, the controller 120 comprises an embeddedLinux operating system that supplies file system and networking support.In one example, the controller 120 includes software features thatprovide relational database functionality, touch screen display drivers,audio generation, BLUETOOTH wireless networking, networking security andfirewalling, and a lightweight web server (as may be included in orcontrolled by the limited functionality component 330) and dataencryption services. The controller 120 can implement a data securitymodel to prevent unauthorized access to the controller 120 and accessonly by authorized authenticated communication devices and/or servers.Accordingly, for any wireless transmission (e.g., BLUETOOTH, WI-FI, orothers) between the controller 120 and the communication device,multiple layers of security can be deployed. For instance, firewallrules may be implemented in the one or more operating systems of thecontroller 120 (including components executing under separate anddistinct operating systems such as the limited functionality component330) and the operating system of the communication device that will notpermit external connections if they do not originate for an authorizedand authenticated device. For example, connections to the communicationdevice may be only made through an authorized remote server (asdescribed in FIGS. 10-12 below). In addition to the firewall rulesabove, each controller 120 may require a unique secure login key. Insome implementations, communications between one or more of thecontroller 120 and the communication device and the communication deviceand the remote server may be configured to be via a Virtual PrivateNetwork (VPN). Further, the controller 120 (e.g., the limitedfunctionality component 330 in the controller 120) can be configured toencrypt any data transmitted to the communication device and/or theremote server in compliance with prescribed security mechanisms forpatient data. For example, such an encryption standard may be an AES 256bit Cypher Block Chaining Technology.

Example Base Station

In some examples, the medical device controller may be in communicationwith a base station capable of performing a number of differentfunctions. FIG. 4 illustrates an example medical device controller 120in communication with a base station 400. As illustrated, base station400 includes an antenna 402, a battery charging bay 404, one or morebuttons 406, a speaker 408, a display 410, and one or more communicationinterfaces 412, 414, and 416. It is appreciated that the base station400, in some examples, may omit one or more of the elements depicted inFIG. 4.

The base station 400 communicates with the medical device controllervia, for example, wireless communication connection 418. The wirelesscommunication connection may be implemented through any one orcombination of wireless communication standards and protocols including,for example, BLUETOOTH, Wireless USB, ZigBee, and Wireless Ethernet. Insome examples, the medical device controller 120 may be paired to aparticular base station 400 through one or more procedures as describedfurther below. The medical device controller 120 may provide, forexample, information regarding the patient's medical condition and/orthe status of the medical device to the base station 400.

The information received by the base station 400 may be communicatedover a network shortly after it is received by the base station 400, oralternatively, may be stored in a memory of the base station 400 andcommunicated over the network at a later time. The information that iscommunicated by the base station 400 may be retained in the memory ofthe base station 400.

Another of the functions performed by the base station 400 is to storeand/or communicate information received from the medical devicecontroller 120 over a wired or wireless communication network. Forexample, information relating to the patient's medical condition over aperiod of time may be communicated by the base station 400 to a medicalservice provider, such as a doctor, so that the doctor may remotelymonitor the patient's medical condition. The base station 400 alsoincludes several different communication interfaces. These communicationinterfaces include a device communication interface 412 to receiveinformation from the controller 120 of the medical device controller120, a telephone network interface 414 to communicate, via a telephonenetwork, the information received from the medical device controller120, and a network interface 416 to communicate, via a wired networkconnection, the information received from the medical device controller120. In certain embodiments, the base station 400 also includes anantenna 402 that can wirelessly communicate the information receivedfrom the medical device controller 120 via a cellular (e.g., 2G, 3G, and4G) network.

In some examples, the base station 400 is capable of charging arechargeable battery for the medical device controller 120. In theseexamples, the base station 400 may include a battery charging bay 404constructed to receive and charge a battery for the medical devicecontroller (e.g., battery 212). The medical device may be provided withmultiple batteries to enable a patient and/or caregiver to charge onebattery while another charged battery is used to provide power to themedical device. The batteries may be swapped between the medical devicecontroller 120 and the base station 400 once the battery in the medicaldevice controller is depleted (or near depleted). It is appreciated thatthe base station 400 may include any number of battery charging bays 404to, for example, charge multiple batteries for the medical devicecontroller 120 simultaneously.

In some examples, the base station 400 is constructed to house acommunication device, such as the communication devices describedfurther below with reference to FIGS. 10 and 11. For example, thecommunication device can be incorporated in an enclosure in the basestation 400 and to prevent removal of the communication device in thefield by persons other than authorized personnel.

In some implementations, the communication device may be releasablysecured and/or coupled into a receptacle of the base station. Forinstance, where the communication device is implemented as orincorporated into a smart phone and/or other portable programmabledevice, the patient may remove the device and carry it elsewhere, e.g.,on his/her person.

Example Hospital Based Medical Device

As discussed above, the medical device controller 120 may be well-suitedfor a range of different cardiac monitoring and/or treatment devices. Insome examples, the medical device controller 120 is part of a hospitalbased medical device. In operation, the hospital based medical devicemay operate in a manner that is different from that of the wearablemedical device 100 described above with respect to FIG. 1. As describedin more detail herein, an interface, prompts, and communicationsperformed by the hospital based medical device can be configured forand/or directed to a user other than the patient 102, e.g., a caregiversuch as a nurse or a patient service representative. For example, acaregiver can program the medical device and/or set the medical deviceup for use by the patient 102. The interface, prompts, andcommunications can be directed to the patient 102 in scenarios such aswhen a response is required to enable the medical device to detectwhether or not the patient 102 is conscious, which can be referenced indetermining when to shock the patient 102, and when a patient is givenan alert to call the caregiver.

FIG. 5 illustrates an example hospital based medical device employingthe medical device controller 120. The hospital based medical device maybe constructed to provide cardiac monitoring and/or treatment forpatients in a hospital setting who may be, for example, bedriddenpatients. Providing patients in a hospital with the hospital basedmedical device may advantageously reduce the time between the patientexperiencing a cardiac event and the notification of hospital staff, theadministration of life-saving defibrillation pulses, and/or theadministration of pacing pulses. Without the hospital based medicaldevice, hospital patients may experience a cardiac event and have towait for a physician to go to the patient's room, assess the conditionof the patient, locate a defibrillation device, attach thedefibrillation device to the patient, and provide treatment to thepatient. Reducing the time between the patient experiencing alife-threatening cardiac event and providing life-saving defibrillationpulses can improve the likelihood of the patient surviving the cardiacevent.

As illustrated in FIG. 5, the hospital based medical device 500 includesthe medical device controller 120 and a sensing component 502. Thesensing component 502 includes a connector 510 constructed to removablycouple to the port 202 of the medical device controller 120. The sensingcomponent 502 may sense information indicative of cardiac activity ofthe patient including, for example, ECG activity, tissue fluid, lungfluid, lung sounds, heart sounds, and/or patient activity. In someexamples, the sensing component 502 includes one or more electrodes 506.The electrodes 506 may be stick-on adhesive electrodes constructed toattach to the patient. In some examples, the electrodes 506 may bedetachable from a wire lead coupling the electrode 506 to the connector510. Constructing the sensing component 502 to make the electrodes 506detachable may enable the patient and/or caregiver to periodically(e.g., every 24 hours) replace the electrodes 506 without replacing theentire sensing component 502. The electrodes 506 may be long term wearelectrodes that are configured to be continuously worn by a patient forextended periods (e.g., 3 or more days). One example of such a long termwear electrode is described in U.S. Patent Application Publication No.US2013/0325096, titled “LONG TERM WEAR MULTIFUNCTION BIOMEDICALELECTRODE,” published Dec. 5, 2013 (hereinafter the “'096 publication”),which is attached hereto as Appendix A and which is hereby incorporatedherein by reference in its entirety.

In some examples, the hospital based medical device 500 may also includea treatment component 504 to provide treatment to the patient. Thetreatment component 504 may include, for example, a therapy pad 508configured to attach to the patient. The treatment component 504 may beconnected to the same connector 510 as the sensing component 502 and/oremploy a separate connector that is capable of coupling to the connector510 in a modular fashion. It is appreciated that the treatment component504 may be integrated into the sensing component 502 in a combinedsensing treatment component. The combined sensing treatment componentmay include an electrode with integrated sensing and treatment deliverycapabilities as described in the '096 publication.

In some examples, the controller 120 of the hospital based medicaldevice 500 is communicatively coupled to a base station such as basestation 400 described above. The hospital based medical device 500 maycommunicate, for example, patient information and/or status informationof the medical device to the base station 400. In these examples, thebase station 400 may issue alerts to medical personnel (e.g., at thehospital) and/or provide the information to a remote server that isaccessible by medical personnel.

Example Monitoring Medical Device

In some examples, the medical device may be a patient monitoring device.For example, such a patient monitoring device may be configured tomonitor one or more of a patient's physiological parameters without anaccompanying treatment component. For example, a patient monitor mayinclude a cardiac monitor for monitoring a patient's cardiacinformation. Such cardiac information can include, without limitation,heart rate, ECG data, heart sounds data from an acoustic sensor, andother cardiac or pulmonary data. In addition to cardiac monitoring, thepatient monitor may perform monitoring of other relevant patientparameters, including glucose levels, blood oxygen levels, lung fluids,lung sounds, and blood pressure using various sensors, such as tissuefluid sensors, heart sounds sensors, lung sound sensors, and pulseoximetry sensors. The primary operations of the patient monitor includemonitoring these patient parameters.

FIG. 6 illustrates an example cardiac monitoring medical device, e.g., acardiac monitor 600. In some implementations, the cardiac monitor 600 iscapable of and designed for being worn by a patient who is at risk ofdeveloping cardiac problems, but who does not yet meet criteria to beoutfitted with a medical device that includes a treatment component(e.g., a defibrillator). Thus, the cardiac monitor 600 may be prescribedso that continuous and/or event-based data can be sent from the cardiacmonitor 600 to a server (e.g., a remote server). A caregiver can accessthe data from the remote server and determine whether the patient isexperiencing or has experienced a cardiac problem. In someimplementations, after determining that the patient is experiencing acardiac problem, the caregiver may instruct the patient to begin wearinga medical device with treatment capabilities.

The cardiac monitor 600 includes the medical device controller 120 ofFIGS. 1-3 along with associated components. In an implementation, thecontroller 120 operates in a similar fashion as described above. Thecardiac monitor includes the plurality of sensing electrodes 112. Insome examples, the sensing electrodes 112 can be an integral part of ahousing structure of the cardiac monitor 600. In other examples, thecardiac monitor 600 includes a discrete housing structure that isdistinct from a housing structure of the controller 120. In theseexamples, the cardiac monitor 600 communicates with the controller 120via a wired or wireless network connection, such as the wirelessconnection 604. The network connection may be implemented through anyone or combination of wireless communication standards and protocolsincluding, for example, BLUETOOTH, Wireless USB, ZigBee, and WirelessEthernet.

In some implementations, the patient can interact with the userinterface 602 to identify a patient symptom. The user interface 602 mayinclude a touchscreen that provides a drop down menu or check listwhich, in turn, allows the patient to select a particular symptom from alist of alternatives. Options for patient systems can include one ormore of: feeling a skipped beat, shortness of breath, light headedness,racing heart rate, fatigue, fainting, chest discomfort, weakness,dizziness, and/or giddiness. In addition, the patient can select a levelof activity (e.g., light activity, moderate activity, rigorous activity,etc.) that he or she was performing when the symptom occurred. In someimplementations, in response to the selection by the patient, thecardiac event detector 326 can cause a portion of patient physiologicalinformation (e.g., in the form of a cardiac signal) to be captured for alength of time that is based on when the symptom was experienced. Forexample, the cardiac event detector 326 can cause a portion of an ECGsignal of the patient to be captured. The portion of the ECG signal issometimes referred to herein as an ECG strip. In some implementations,the cardiac monitor 600 can continuously record ECG data, and at thesame time also identify and record one or more ECG strips relating toone or more events of interest (e.g., patient-reported symptoms, eventsdetected by the cardiac event detector 326, etc.). As such, if acaregiver wishes to view ECG data for a period of time prior to or afterthe recorded ECG strip relating to an event of interest, such data isavailable for review from the continuously-recorded ECG data.

Limited Functionality Component

As described above, in some examples, a medical device includes alimited functionality component (e.g., the limited functionalitycomponent 330) that is configured to implement a limited functionalityinterface through which a medical device controller (e.g., thecontroller 120) receives, processes, and responds to commands definedwithin a limited functionality command set. This interface may be anapplication program interface (API) that is implemented using a varietyof interoperability standards and architectural styles. For instance, inone example, the interface is a web services interface implemented usinga representational state transfer (REST) architectural style. In thisexample, the interface communicates with a communication device (e.g.,the communication devices described below with reference to FIGS. 10 and11) using Hypertext Transfer Protocol (HTTP) along with JavaScriptObject Notation and/or extensible markup language. In some examples,portions of the HTTP communications may be encrypted to increasesecurity, such as by use of HTTPS and/or encrypted URI arguments. Inother examples, the API is implemented using a proprietary applicationprotocol accessible via a transmission control protocol socket. Thus thelimited functionality interface as described herein is not limited to aparticular implementation standard.

Both the contents of the command set and the manner in which the commandset is executed by the limited functionality component are configured tonot affect any primary operation of the medical device. In someexamples, such contents and manner in which the command set is executedby the limited functionality component are configured to be unable toaffect any primary operation of the medical device. For instance, themedical device and the limited functionality component are configured sothat the command set is executed using secondary computing resourcesthat are isolated from primary computing resources used to executeprimary operations. This isolation may be physical isolation (e.g.,different physical processors or different physical processing cores) orvirtual (e.g., different virtual processors, different processingthreads having the same or different thread priorities). By isolatingresources used to execute primary operations from resources used toexecute limited functionality operations, these examples render thelimited functionality component unable to affect the primary operations.

FIG. 7 illustrates some example implementations that utilize isolatedcomputing resources to support execution of a limited functionalitycomponent while preventing adverse effects on the primary operations ofa medical device. As shown, FIG. 7 includes the controller 120, whichoperates generally as described above. However, in the controller 120illustrated by FIG. 7, the data storage 304 includes primary data store700 and secondary data store 702; the processor 318 includes at leasttwo processors: a primary processor 704 and a secondary processor 706;and the limited functionality component 330 includes a resource monitor732 and a plug-in manager 734. Examples may include any one or more ofthese features without departing from the scope of this disclosure.

In some examples in accord with FIG. 7, the limited functionalitycomponent 330 is implemented solely by one or more processors includingthe secondary processor 706. In these examples, the primary processor706 and/or processors other than the one or more processors includingthe secondary processor 706 implement other components of the controller120. This isolation of the limited functionality component from othercomponents of the controller 120 protects the other components of thecontroller 120 from being affected by the limited functionalitycomponent.

In some implementations, one or more of the processors 318 is a discretephysical processor. In other implementations, one or more of theprocessors 318 is a distinct core of a single multicore processor. Insome implementations, one or more of the processors 318 is a virtualprocessor implemented by one or more physical processors, each of whichmay be a single core or multicore processor. In at least oneimplementation, the processor 318 includes a power conserving processorarrangement as described in U.S. Pat. No. 8,904,214, titled “SYSTEM ANDMETHOD FOR CONSERVING POWER IN A MEDICAL DEVICE,” issued Dec. 2, 2014(hereinafter the “'214 patent”), which is attached hereto as Appendix Band which is hereby incorporated herein by reference in its entirety.Other configurations of processors may be used to implement theisolation scheme described herein without departing from the scope ofthis disclosure.

In some examples, the primary data store 700 includes data related toprimary operations of the controller 120. In these examples, thesecondary data store 702 includes data related to limited functionalityoperations that are under control of the limited functionality component330 (e.g., operations other than the primary operations). In someexamples, the limited functionality component and/or the commands itexecutes exercise full control over data stored in the secondary datastore 702 but are restricted to no access or read-only access of datastored in the primary data store 700. In these examples, othercomponents of the controller 120 may exercise full control over datastored in the primary data store 700 and the secondary data store 702.In this way, components of the controller 120 other than the limitedfunctionality component may manipulate data as needed to execute theprimary operations of the controller without being affected by commandsexecuted by the limited functionality component.

In some implementations, the primary data store 700 and the secondarydata store 702 are different storage locations within a single physicaldata storage medium, such as a magnetic disk, flash memory, or RAM. Inother implementations, the primary data store 700 and the secondary datastore 702 are storage locations within discrete physical data storagemediums.

In at least one implementation, the primary data store 702 isimplemented using the shared memory described in '214 patent. As such,the limited functionality component may be configured to have onlyread-only access to the contents of the shared memory. For example, theshared memory may be used to store ECG data (e.g., 1-5 minutes or moreECG data). Accordingly, in some implementations, the limitedfunctionality component may be configured to, during normal operation ofthe medical device, read and transmit the stored ECG data in a streamingmanner to allow the communication device to receive and process such ECGdata. Other configurations of data storage may be used to implement theisolation scheme described herein without departing from the scope ofthis disclosure.

In some examples, the medical device and the limited functionalitycomponent are configured so that the command set is executed usingcomputing resources that are shared by the limited functionalitycomponent and the components configured to execute the primaryoperations of the medical device. In these examples, the limitedfunctionality component is configured to comply with one or morecomputing resource policies.

These computing resource polices may be hardcoded (e.g. built into theprogramming of the limited functionality component and set at compiletime) or data-driven (i.e. read in by the limited functionalitycomponent and set at runtime). In some examples, such policies may bewritten to a data file and downloaded to the medical device during adevice update in the field. Such a scheme can allow for any desired orrequired security updates to medical devices in the field. In somecases, for increased security, policies and/or features affecting thelimited functionality component of the medical device may not be updatedin the field but be returned to a service center for any such updatesduring maintenance.

In some implementations, the limited functionality component includesthe resource monitor 732. The resource monitor 732 is configured tocause the limited functionality component to comply expressly with acomputing resource policy by actively monitoring and/or allocating theshared computing resources available for execution of the command set.Additionally, in some implementations, the limited functionalitycomponent is configured to comply inherently with a computing resourcepolicy so that no monitoring is required. For instance, the programmingof the limited functionality component may cause it to consume a limitedamount of the shared computing resources without express reference to acomputing resource policy. In either of these implementations, thelimited functionality component and the command set are configured toutilize no more than a maximum amount of the shared computing resources.This maximum is sufficiently low so as to maintain a minimum amount ofthe shared computing resources that are dedicated to the primaryoperations of the medical device, thereby preventing any adverse effectsto the primary operations. For example, such a maximum may be expressedas and stored as a percentage of the shared computing resources. Forexample, such a maximum may be expressed as and stored as a valuerepresenting the maximum shared resources (e.g., an amount of run-timememory storage in megabytes or gigabytes.)

In some implementations, the limited functionality component includesthe plug-in manager 734. The plug-in manager 734 is configured toreceive, validate, install, execute, upgrade, and/or uninstall plug-insreceived from a communication device (e.g., the communication devicesdescribed below with reference to FIGS. 10 and 11) or other authorizedsource (e.g., directly from remote servers described in FIGS. 10 and11). These plug-ins may extend the functionality of the limitedfunctionality component 330. For instance, the plug-ins, once installedand operational, may enable the limited functionality component toprocess new and additional commands. These new commands may be entirelynew functionality or may be built upon previously available commands.

Plug-ins may be distributed as any of a variety of component types.These types include stand-alone executables, libraries, and scripts. Assuch, the plug-ins may be written in C or C++ and may be statically ordynamically linked. Plug-ins that are distributed as libraries mayimplement a predefined API that the plug-in manager 734 is configured tocall to execute the plug-in.

In one example, the plug-in manager is configured to validate a newlyreceived plug-in by authenticating the source of the plug-in. Thisauthentication may be executed using password authentication orcertificated-based authentication. For instance, the plug-in may besigned by a trusted source's private key and verified by the plug-inmanager 734 using the source's public key. One example of the use ofplug-ins in conjunction with the limited functionality component 330 isdescribed further below with reference to FIG. 12.

In some implementations, the limited functionality component isconfigured to protect the primary operations of the medical device bylimiting execution of commands along various dimensions. This limitationmay be a complete prohibition from executing a command, executing thecommand in a manner that consumes less computing resources (e.g.,provide only heartbeat information rather than a full array of ECGdata), executing the command less frequently than specified by thecommunication device, etc. For instance, according to one example, thelimited functionality component is configured to execute only commandsthat are members of the limited functionality command set (i.e., onlythose command types that have been tested and proven to not adverselyaffect primary operations). In some examples, the limited functionalitycomponent may additionally be configured to limit execution of commandsto: a threshold number of commands per time period, a threshold numberof active commands, a threshold percentage of processor utilization, athreshold percentage of memory consumption, and a threshold number ofthreads. In some examples, the limited functionality component mayadditionally be configured to shut down execution of commands based on,e.g., transgressions relating to the threshold number of commands pertime period, the threshold number of active commands, the thresholdpercentage of processor utilization, the threshold percentage of memoryconsumption, and the threshold number of threads. One or more suchlimits or shut down criteria can be configured by a user withadministrator level access to a device interface of the medical device.It is appreciated that many other limits, shut down criteria, and/ormodes of controlling the limited functionality component other than theexamples given herein may be used. In some examples, the limitedfunctionality component is configured to limit or shut down commandexecution based on processor type or based on an amount of power left ina battery, such as the battery 310. For instance, when executingaccording to this configuration, the limited functionality component maycompare the amount of power left to one or more threshold values (e.g.,10% battery power remaining, 1 hour of power remaining, etc.) andprevent or terminate command execution.

In some implementations, the limited functionality component may beconfigured to limit or shut down command execution in a specific wayduring execution of other, identified operations. For instance, thelimited functionality component may prevent execution of any commandthat affects the user interface of the medical device while the medicaldevice is executing a treatment protocol. In some examples, a treatmentprotocol comprises device and user actions that are executed orperformed when the medical device detects a treatable arrhythmia. Forinstance, when the arrhythmia is detected, a vibration alarm isactivated which continues throughout the treatment protocol.Subsequently, a siren alert may be given. In some examples, if anarrhythmia is detected during a sleep period (e.g., when the patient isasleep), the vibration and siren alerts can be activated together. Theuser interface displays a message prompting a conscious patient toprovide a response indicating that the patient is conscious, and as suchthe treatment may be suspended. This keeps inappropriate arrhythmiadetections from becoming inappropriate shocks. For example, if thepatient presses one or more “response” buttons disposed on thecontroller 120 at any time during the treatment sequence, the alertsstop and the treatment shock is delayed. If the patient does notrespond, the device continues to give alerts and voice prompts to thepatient and bystanders. The entire treatment protocol, from arrhythmiadetection to delivery of the treatment shock, may take less than oneminute. If the arrhythmia continues after the first treatment shock, afurther shock may be delivered. In such situations, the limitedfunctionality component may allow execution of commands that transmitdata to the communication device for display by the communication devicewhile the treatment protocol is ongoing.

In some implementations, the limited functionality component may includea web server that can be accessed via a secure authenticated sessionwith the communication device. For example, the communication device maycomprise a web browser or a web client configured to interact with theweb server, using Internet Protocol (IP) and/or Hypertext TransferProtocol (HTTP/HTTPS) and/or other similar protocols, as describedherein. In some examples, the communication device may be limited tointeracting with the medical device based on a type of protocol. Forexample, only web interactions using the web server based HTTP/HTTPSprotocol outlined above may be permitted. In some implementations, othertypes of web service protocols such as REST, XML-RPC, SOAP, and JSON-RPCmay be implemented.

Limited Functionality Command Set

The limited functionality command set may include commands that, whenexecuted by the limited functionality component, perform a wide varietyof actions. Table 1 lists some example commands in a command setaccording to at least one example.

TABLE 1 Command Description Get (Element_ID) Returns a value of the dataelement identified by Element_ID. Set_Threshold Creates an associationbetween the specified Value and Element_ID. (Value, Element_ID) WatchCauses the limited functionality component to monitor the data(Element_ID, element identified by the Element_ID according to theWatch_Type. Watch_Type, Detected transgressions of the value of the dataelement will be Report_Frequency) reported to the address specified bythe Watcher_Address at a frequency specified by the Report_Frequency.Set_Watcher Causes the limited functionality component to associate thewatch (Watch_ID, identified by the Watch_ID with the Watcher_Address.Reports Watcher_Address) generated by the Watch_ID will be reported tothe Watcher_Address. Display_Message Causes the limited functionalitycomponent to request that the user (Message_ID) interface of the medicaldevice display a predefined message identified by the Message_ID.Replace_Message Causes the limited functionality component to replacethe predefined (Message_ID, message identified by the Message_ID withthe New_Message. New_Message) Create_Message Causes the limitedfunctionality component to create a message with (New_Message) thecontent of New_Message. Display_Object Causes the limited functionalitycomponent to receive an object (Object_Address) stored on thecommunication device at the Object_Address and display the object viathe user interface of the medical device. Request_Method Causes thelimited functionality component to call the Method_ID of (Component_ID,medical device component identified by the Component_ID with theMethod_ID, Method_Args, thereby requesting execution of the Method_IDwith Method_Args) the Method_Args. Filter_Data Causes limitedfunctionality component to apply a filter (e.g., Low (Data, Filter_ID)Pass, High Pass, Band Pass, Wavelet . . .) identified by the Filter_IDto the Data before transmitting the data to the communication deviceCorrelate_Data Causes the limited functionality component to calculateand transmit (Data_Set_ID1, a correlation of the two datasets identifiedby the Data_Set_ID1 and Data_Set_ID2) Data_Set_ID2s.

Element_IDs identify data elements exposed by the limited functionalityinterface. Data elements may be retrieve via the limited functionalityinterface via the Get( ) command. These data elements may be stored in adata store (e.g., the primary data store 700 or the secondary data store702) of the medical device. Data elements may be descriptive of variousinformation regarding the patient, the medical device, the environmentof the medical device, the communication device, the user of thecommunication device, and the environment of the communication device.More specifically, data elements may be descriptive of patientparameters (e.g., ECG data and heart sound data), predefined messages,new message, and/or modified messages. Data elements may also bedescriptive of metrics indicative of a status of the medical device,such as electrode fall-off status; and other information regarding thepatient or medical device, such as patient location data, patient name,and prescription compliance data. Other examples of specific dataelements include images received from the communication device andmetrics descriptive of the signal strength of a network connectionbetween the medical device and the communication device and an amount ofpower remaining in a battery included in the communication device.

Commands, such as Display_Message( ), Replace_Message( ),Create_Message( ), and Display_Object( ), that affect the user interfaceof the medical device may be referred to herein as “interface commands.”In some examples, the limited functionality component transmitsinterface commands to the user interface component for processing by theinterface component. In some examples, the Replace_Message( ) interfacecommands is configured to determine whether the Message_ID targeted formodification may be modified prior to execution the modification. Insome examples, the Replace_Message( ) interface command makes thisdetermination by identifying whether the message has been flagged asrestricted. By referencing flags that potentially restrict access toparticular messages, the Replace_Message( ) interface command isconfigured to be unable to affect primary operations of medical devices.

Commands, such as Correlate_Data( ) and Filter_Data( ), that manipulatedata generated by operation of the medical device after completion ofthe operation and prior to transmitting the data to the communicationdevice are referred to herein as “post process commands.” As describedabove, the Filter_Data( ) command applies a filter to data generated byoperation of the medical device. In this way, the Filter_Data( ) commandmay be used to remove outliers and other undesirable artifacts from dataprovided to the communication device. Also as described above, theCorrelate_Data( ) calculates correlations between two or more data sets.For example, such a correlation can include correlation between ECG dataand accelerometer data.

In some implementations, the components of the medical device thatexpose interfaces supporting the Request_Method( ) interface commandinclude logic that determines whether the method identified by theMethod_ID, if executed with the Method_Args, might affect a primaryoperation of the medical device. If such execution might affect anyprimary operation, the component will not execute the Method_ID. In thisway, the Request_Method( ) interface command complies with an expresslyor inherently implemented computing resource policy. In someembodiments, the resource monitor 732 monitors and enforces suchcomputing resource policies, thereby freeing other components from thiscomputational burden.

Other Virtualization Examples

In some implementations, the components of the medical device controller120 may protect the primary operations of the controller 120 byexecuting a single operating system with two or more kernels (e.g.,Xenomai operating system extension). In this implementation, the primaryoperations are serviced by a first kernel that executes one or morepatient care components and the limited functionality operations areserviced by a second kernel that executes a limited functionalitycomponent (e.g., the limited functionality component 330). Further, inthis implementation, the first kernel is executed with greater prioritythan the second kernel. In this way, the primary operations are isolatedfrom and not affected by the limited functionality operations.

In some implementations, the components of the medical device controller120 may protect the primary operations of the controller 120 byexecuting a supervisory operating system (e.g., a hypervisor) thatmanages subordinate operating systems. The hypervisor may be a “baremetal” hypervisor (i.e., a hypervisor that manages the computinghardware of the controller 120 directly), or a “hosted” hypervisor(i.e., a hypervisor that utilizes the services of another operatingsystem that, in turn, manages the computing hardware of the controller.In these implementations, the primary operations are serviced by a firstoperating system that executes one or more patient care components andthe limited functionality operations are serviced by a second operatingsystem that executes the limited functionality component. Further, inthis implementation, the first operating system is executed with greaterpriority than the second operating system. In this way, the primaryoperations are isolated from and not affected by the limitedfunctionality operations.

Limited Functionality Interface Processes

As described above, some examples execute one or more interfaceprocesses. FIG. 8 illustrates two such processes, an interface process800 and an interface process 802. As shown, the interface process 800 isexecuted by a limited functionality component of a medical device, suchas the limited functionality component 330. The medical device includingthe limited functionality component may be any medical device describedherein. Also as shown, the interface process 802 is executed by acommunication device, such as the communication device 800 describedfurther below with reference to FIG. 8.

The interface process 802 starts in act 810, where the communicationdevice transmits a command to the limited functionality component. Thiscommand may be any command from the command set executable by thelimited functionality component and may be configured to not affectprimary operations of the medical device. The communication device maybe configured to be unable to issue commands other than those from thecommand set executable by the limited functionality component.

The interface process 800 starts in act 804, where the limitedfunctionality component receives the command from the communicationdevice. In act 806, the limited functionality component processes thecommand. One example of the acts executed by the limited functionalitycomponent within the act 806 is described further below with referenceto FIG. 9.

In act 808, the limited functionality component transmits to thecommunication device one or more responses resulting from execution ofthe command and the interface process 808 ends. As described above,depending on the command executed, the response may include informationgenerated by or stored on the medical device. In some examples, theresponse includes configuration information that enables thecommunication device to receive one or more on-going transmissions ofinformation (e.g., streams generated by a Watch( ) command) from thelimited functionality component. These on-going transmissions may be inresponse to a predetermined condition, substantially in real time,during an occurrence of the predetermined condition, in response to userinput, in response to a predetermined triggering event, continuous overa period of time, substantially continuous over a period of time, duringperiodic time intervals, or during aperiodic time intervals.

In act 812, the communication device receives the one or more responses.In the act 814, the communication device processes the response and theinterface process 802 ends. Interface processes in accord with theinterface process 800 and 802 enable a medical device to shareinformation with one or more communication devices without impactingprimary operations of the medical device.

As described above, some examples execute one or more command processingprocesses. FIG. 9 illustrates one such process, a command processingprocess 900. As shown, the process 900 is executed by a limitedfunctionality component of a medical device, such as the limitedfunctionality component 330. The medical device including the limitedfunctionality component may be any medical device described herein or adifferent type of medical device.

The process 900 starts in act 902, where the limited functionalitycomponent parses the command to identify the command type and commandarguments. In act 904, the limited functionality component determineswhether the communication device that originated the command (e.g. thecommunication device 800 described further below with reference to FIG.8) is an authorized communication device. In at least one example, thelimited functionality component makes this determination by firstauthenticating the identity of the communication device and thendetermining whether the identity of the communication device has beenpreviously identified and granted authorization to execute the command.The identity of the communication device may be authenticated usingpassword authentication or certificated-based authentication, amongother mechanisms. If the communication device is authorized to requestexecution of the command, the limited functionality component executesact 906. If the communication device is not authorized to requestexecution of the command, the limited functionality component executesact 908 or act 910.

In the act 908, which is optional, the limited functionality componentdetermines whether execution of the command complies with all applicablecomputing resource policies. The act 708 is performed only by examplesthat expressly load and evaluate computing resource policies. In theseexamples, the limited functionality component implements the resourcemonitor 732 to evaluate the computing resource policies. For instance,in one example, a computing resource policy requires that each computingresource utilized by limited functionality operations must be less thana corresponding threshold value of a set of threshold values. Eachthreshold value of the set of thresholds represents a differentcomputing resource of the medical device. In some examples, the set ofthreshold values includes a threshold value for compute resources, athreshold value for data storage resources, and a threshold value forbattery power. In these examples, the resource monitor predicts thetotal computing resources of each type to be consumed by all limitedfunctionality operations, should the limited functionality componentexecute the command. If none of the predicted resource utilizationvalues exceed its corresponding threshold value, execution of thecommand is in compliance with the computing resource policy. Othercomputing resource policies may be evaluated by the resource monitor732. The examples disclosed herein are not limited to any particularresource policy.

If execution of the command complies with all applicable computingresource policies, the limited functionality component executes the act910. If execution of the command does not comply with all applicablecomputing resource policies, the limited functionality componentexecutes act 912.

In the act 906, the limited functionality component reports the attemptto execute a command by the unauthorized communication device andterminates execution of the command execution process 900. For instance,the limited functionality component may report the authorizedcommunication device's attempt by displaying a notification on a userinterface (e.g., the user interface 308) of the medical device or bytransmitting a notification to a remote device.

In the act 912, the limited functionality component delays or abortsexecution of the command and terminates the command execution process900. Whether the execution of the command is delay or aborted in the act912, may depend on a variety of factors including the values of one ormore configurable variables of the medical device, the command type, thecommand arguments, and the identity and authorization of thecommunication device. Further, in some examples, the limitedfunctionality component may report the delay or aborted command bydisplaying a notification on a user interface (e.g., the user interface308) of the medical device or by transmitting a notification to a remotedevice (e.g., the communication device).

Notification Systems

As described above, in some examples, the limited functionalitycomponent is in data communication with one or more communicationdevices. FIG. 10 illustrates a notification system 1000 in accord withsome of these examples. As shown, the notification system 1000 includesa medical device 1002, a communication device 1004, a remote server1012, a network connection 1006 and a communication network 1014. Themedical device 1002 exchanges information with the communication device1004 via the network connection 1006. Similarly, the communicationdevice 1004 may exchange information with the remote server 1012 via thenetwork 1014. In at least one example, the remote server 1012 isconfigured to deploy one or more components (e.g., programs or “apps”)to the communication device 1004 that cause the communication device1004 to transmit particular commands to the medical device 1002.

The network connection 1006 may be implemented through any one orcombination of wireless communication standards and protocols including,for example, BLUETOOTH, Wireless USB, ZigBee, and Wireless Ethernet. Thenetwork 1014 may include any communication network through whichprogrammable devices may exchange information. In some examples, thenetwork 1014 supports wireless network and/or wired connections. Forinstance, the network 1014 may support any of various networkingstandards such as GSM, CMDA, USB, BLUETOOTH, CAN, ZigBee, WirelessEthernet, and TCP/IP among others.

The medical device 1002 may include any medical device disclosed hereinor a different medical device that includes a limited functionalitycomponent for facilitating the interactions shown in FIG. 10. In oneexample illustrated by FIG. 10, the medical device 1002 is associatedwith and provides care to a patient 1010. In this example, thecommunication device 1004 is also associated with and providesinformation to the patient 1010. For example, the communication device1004 may be incorporated into a base station and/or medical devicecharger unit placed in the patient's home or other convenient location,e.g., similar to the base station system shown in and described inconnection with FIG. 4. Accordingly, the communication connection 418 ofFIG. 4 is similar to the network connection 1006 of FIG. 10. In someimplementations, the communication device 1004 may be releasably securedand/or coupled into a receptacle of the base station as described above.

In various examples, the communication device 1004 is implemented usingany of a variety of programmable devices (e.g., a device with datastorage and at least one processor in data communication with the datastorage). In some examples, the communication device 1004 includes aplurality of interfaces, one or more processors, and a data storagedevice coupled to one another via a communication mechanism, such as abus. In these examples, the communication device 1004 also includes abattery to power the device and may include one or more antennas. Theplurality of interfaces in the communication device 1004 include a userinterface, a network interface configured to communicate with thenetwork 1006, and a medical device interface configured to exchangeinformation with the medical device. This information may include one ormore limited functionality commands.

Particular examples of the communication device 1004 include medicaldevices (e.g., in FIG. 10, medical devices other than medical device1002), wearable devices, medical device chargers, medical device basestations, smart phones, tablet computers, and laptop computers. Wearabledevices that may serve as the communication device 1004 include variousgarments with integrated technologies, watches, anklets, necklaces, beltbuckles, and glasses.

In examples where the communication device 1004 is implemented via asmart phone, a dedicated software application (or an “app”) may bedownloaded to the smart phone to facilitate the interactions describedherein. In some examples, as an enhanced security measure, thecommunication device 1004 is configured to automatically and exclusivelyexecute such an application when the communication device 1004 isconnected to a power source or when the communication device 1004 powersup. In such examples, the smart phone operates solely as thecommunication device 1004 for enabling the communications andinteractions described herein. For example, the smart phone may beconfigured to operate in a “kiosk mode” and display only minimalinformation on the user interface during such operation. For instance,the application may be written for an Android, iOS, Windows, or otheroperating system of the smart phone.

In some examples, the communication device 1004 is included within ahousing structure of the medical device 1002. As such, the limitedfunctionality component can communicate with the communication device1004 through one or more communication mechanisms incorporated withinthe integrated circuitry of the medical device 1002.

In some examples, the communication device 1004 is configured to act asan information conduit (or “hotspot”) for the medical device 1002 byexchanging information regarding the medical device 1002, the patient1010, and the environment of the medical device 1002 with a remoteserver 1012 via a communication network 1014. For example, in animplementation where the communication device 1004 is configured as aninformation conduit, the communication device 1004 is configured to passdata between the medical device 1002 and the remote server 1012 withoutmodifying the data. In certain cases, the device 1004 may performcertain limited transformations on the data prior to relaying the datato the remote server 1012 (or to the medical device 1002 if the data isbeing transmitted from the remote server 1012).

In some examples, the communication device 1004 can establish anauthenticated and secure connection over the network 1014 via anothercomputing device (e.g., a desktop workstation, laptop workstation,tablet or other such device). For example, the user may cause thecommunication device 1004 (e.g., a smart phone) to establish a wired(e.g., USB connection) or wireless connection (e.g., BLUETOOTHconnection) with the other computing device to connect to the remoteserver 1012.

In some examples, the communication device 1004 may vary its operationbased on whether or not it has connectivity to the network 1014. Forinstance, if the communication device 1004 has no or limited networkconnectivity (e.g., no or limited cellular network connectivity), themedical device data can be stored to a local storage component on thecommunication device 1004. For instance, the local storage component canbe an SD card or an embedded storage device in the device 1004. The datacan be stored in an encrypted format that is compliant with patient datasecurity requirements. This locally stored data can be transmitted tothe remote server 1012 when connectivity is restored. For instance, apatient carrying the communication device 1004 may be able to eithercarry the device 1004 to an area with better signal strength or hand thedevice over to another user who can travel to such an area. In someimplementations, the patient and/or other user may use a wired orwireless connection to another computing device (e.g., a desktopworkstation, laptop workstation, tablet or other such device) that canestablish a connection to the network 1014 to cause the transmission ofthe data to the remote server 1012.

For example, the communication device 1004 can include a callbackmechanism registered and called by the operating system of the device1004 to monitor the available network signal strength. For example, inthe Android operating system, a signal strength monitoring component canbe included. The signal strength monitoring component can be configuredwith one or more predetermined criteria indicating, for example, aminimum threshold signal strength that may be available before the datacan be transmitted to the remote server 1012. Other criteria can bebased on, for example, confirming the stability of the signal strengthover a period of time. As such, the signal strength monitoring componentcan verify that the signal strength maintains a threshold strength for acertain amount of time, and/or verify that connectivity to the networkis available, before the transfer of stored information is initiated. Inan implementation, an example mechanism to send the stored data from thedevice 1004 to the remote server 1014 can be based on the UFTP filetransfer protocol.

In some examples, the communication device 1004 has two modes ofoperation: internal and external. The internal mode is designed for usewith a communication device 1004 where the communication device 1004 isenclosed in the housing structure of the medical device 1002. In someexamples, such enclosure completely hides the communication device 1004from external view. In some examples, when executing in internal mode,the communication device 1004 is configured to automatically power downwhen not in use and/or when disconnected from a power source. In someimplementations, the communication device 1004 may include a dedicatedpower source. For example, such a power source can be a rechargeablebattery, e.g., a Li-Ion based battery power supply. In some examples,the power source can be a non-rechargeable battery.

In contrast to the internal mode, the external mode is designed for usewith a communication device 1004 where the communication device 1004 isvisible and accessible to the patient 1010. For example, a userinterface disposed on the communication device 1004 may display statusinformation relating to the communication device 1004 and any ongoingcommunication exchange(s) as described herein.

According to some examples, the communication device 1004 can beconfigured to automatically setup communications between the medicaldevice 1002 and the remote server 1012. In these examples, thecommunication device 1004 is further configured to display informationregarding its operation and data communications via a user interface ofthe communication device 1004 but restrict user interaction with theuser interface. In some implementations, the user may only be able topower on or off the device. In other implementations, the user may onlybe able to control screen brightness and timeouts. The operation anddata communication information displayed may include battery level,connection strength to the network 1014, status of connectivity betweenthe communication device 1004 and the medical device 1002 including, insome cases, status information for any ongoing communications, andversion information for the hotspot component. The communication device1004 may transmit the operation and data communication information tothe remote server 1012. Additionally, the communication device 1004 maytransmit information descriptive of its location to the remote server1012 (e.g., GPS coordinates or other position/location details). In someexamples, the communication device 1004 is configured to transmitinformation descriptive of the connection strength to the medical device1002. Further, in some examples, the communication device 1004 isconfigured to establish a firewall that will inhibit any unauthorizedconnections to the medical device 1002. The firewall can be configuredto inhibit any connections to the medical device 1002 other than throughthe communication device 1004. In some examples, the communicationdevice 1004 is configured to log errors in the data storage of thecommunication device 1004 (or a storage in some other location on thenetwork).

In some examples, the communication device 1004 is configured toautomatically execute as a hotspot component when the communicationdevice 1004 is connected to a power source or when the communicationdevice 1004 powers up. Also, in these embodiments, the communicationdevice 1004 is configured to exclusively execute the hotspot component.In various implementations, the communication device 1004, whenconfigured as the hotspot component or otherwise, complies with 21 CFR §880.6310 which defines a Medical Device Data System (MDDS). In oneexample, the communication device 1004 comprises hardware or softwareproducts that can be configured to transfer, store, convert formats, anddisplay medical device data. In such examples, the communication device1004 can be configured, using the techniques and systems describedherein, to not modify the data, modify the display of the data, and/orcontrol the functions or parameters of the medical device or any othermedical device.

Two additional examples in which the limited functionality component andthe communication device interoperate to achieve certain benefits willnow be described. In a first example, the medical device 1002 includes awearable defibrillator. Further, in this example, the patient 1010 isfitted with the medical device 1002 and is prescribed an exercise and/oractivity regimen (e.g., in connection with a medical rehabilitationprogram). Compliance with the regimen requires the patient 1010 toperform, e.g., certain actions in accord with a prescribed treatmentschedule. The prescribed treatment schedule may, in some cases, requirethe patient 1010 to exercise for 30 minutes each day and/or takemedication three times a day. In this example, a primary operation ofthe medical device 1002, which is a wearable defibrillator, may be tomonitor and treat the patient 1010 in the event a cardiac arrhythmia isdetected at any point in time, including while the patient 1010 iscomplying with the regimen.

Continuing this example, the patient 1010 and/or a physician at a remotelocation (accessible via the network 1014) wishes to be notified ifcertain patient parameters transgress one or more configurable thresholdvalues. More specifically, the patient 1010 and/or the physician wishesto be notified if the patient's heart rate exceeds 180 bpm or theelapsed time since last compliance with the treatment schedule exceeds 1day. To configure the notification system 1000 to notify the patient1010 and/or the physician where these patient parameters transgressthese threshold values, the patient 1010 interacts with a user interfaceof the communication device 1004. Alternatively, the physician mayinteract with a network device in communication with the remote server1012 to configure the notification system 1000. This interaction resultsin the communication device identifying several commands that, whenexecuted by a limited functionality component, will collectivelyconfigure the threshold values for the patient parameters describedabove. In response to identifying these commands, the communicationdevice transmits, via a network interface of the communication device,requests including the commands to a limited functionality component(e.g., the limited functionality component 330) of the medical device1002.

In this example, the limited functionality component receives therequests and, in response to such receipt, parses the requests toidentify the commands, the patient parameters, and the threshold values.Next, the limited functionality interface executes the identifiedcommands to store an association between the threshold values and thepatient parameters.

In this example, the limited functionality component, as part ofexecuting the identified commands, also stores an address of a recipientdevice to which notifications will be transmitted. This recipient devicemay be the communication device 1004 or some other device in datacommunication with the network 1014.

In some examples, the communication device 1004 can be configured totransmit one or more requests to execute one or more limitedfunctionality commands to the medical device 1002 and relay the resultsof those commands to a device at a remote location (e.g., accessibleover the network 1014). For example, a physician may wish to be notifiedon his/her own handheld device when the patient's heart rate exceeds athreshold value during performance of a prescribed regimen. For example,a physician may wish to be notified on his/her own handheld device inthe event a patient has an arrhythmia event during performance of aprescribed regimen.

In another example, the communication device 1004 can be configured totransmit one or more requests to the limited functionality component toexecute one or more commands that, when executed, configure the limitedfunctionality component to transmit notifications to the communicationdevice 1004 and/or the remote server 1012 in response to detecting apredetermined trend or pattern in the underlying data. For example, whenexecuting according to this configuration, if the patient's heart rateincreases over a period of time, the limited functionality component cantransmit a notification regarding the upward trend or pattern. Inanother example, the limited functionality component can be configuredto transmit a notification describing a low range of heart ratevariability detected over a specified period of time. Thus, in someexamples, the limited functionality component is configured to transmitnotifications in response to a pattern detected in an underlying patientparameter rather than a single triggering value.

Additionally, in this example, the limited functionality component, aspart of executing the identified commands, starts a watch that monitorsthe patient parameters, and transmits a notification to a recipientdevice (e.g., the communication device 1004 or other device connected tothe network 1014) if any of the patient parameters transgresses itscorresponding the threshold value and/or if any underlying patientparameters change in accordance to one or more predetermined trends orpatterns.

Also, in this example, the limited functionality component, as part ofexecuting the identified commands, requests that the user interfacecomponent prompt the patient 1010 for information regarding compliancewith the treatment schedule and return any information received inresponse to the prompt. More particularly, in this example, the limitedfunctionality interface requests that the user interface prompt the userto indicate whether the user has taken their medication according to thetreatment schedule. In response to receiving returned information fromthe user interface indicating that the user has not complied with thetreatment schedule or in response to determining that the user has notcomplied via other mechanisms (e.g., by monitoring patient parametervalues), the limited functionality component transmits a notification tothe communication device 1004.

In response to receipt of a notification, the communication device 1004processes the notification and alerts the patient 1010 and/or thephysician of the value of the patient parameters. In this example, thealerts may indicate that the patient's heart rate has exceeded 180 bpsand that the patient has not complied with the treatment schedule for 1day.

In a second example illustrated by FIG. 12, the notification system 1000is used to distribute a heart rate variability plug-in 1202 to themedical device 1010. As shown, the notification system 1000 illustratedin FIG. 12 includes generally the same components as, and functionsgenerally in the same way as, the notification system 1000 illustratedin FIG. 10.

In this example, a user 1200 authors and selects the plug-in 1202 fordistribution to the medical device 1002. The plug-in 1202 is configuredto monitor the heart rate variability of the patient 1010 over time. Asdescribed above, the plug-in 1202 may take the form of a script,stand-alone executable, or library, among other forms. When executingaccording to its configuration, the heart rate variability plug-in 1202tracks the heart rate of the patient over a configurable time window andtransmits one or more notifications to the communication device 1004 ondetecting the occurrence of certain heart rate or variability triggeringcriteria and/or changes, trends, or patterns in the underlying heartrate or variability. Further, in this example, the communication device1004 may transmit any such notifications received from the medicaldevice 1002 to the remote server 1012 via the network connection 1014.In some examples, the plug-in 1202 may be configured to exchangeinformation, including transmitting such notifications, directly withthe remote server 1012. These notifications are thereby available forreview by the user 1200 and/or a physician. In at least one example, theuser 1200 is a physician or other care provider.

As shown in FIG. 12, responsive to the user 1200 selecting the plug-in1202 for distribution, the remote server transmits the plug-in to thecommunication device 1004 via the network 1014. The communication device1004 receives the plug-in 1202 and, in response, transmits the plug-in1202 to the medical device 1002 via the network connection 1006.

In response to receiving the plug-in 1202, a plug-in manager (e.g., theplug-in manager 734) authenticates the source of the plug-in 1202 as atrusted source, installs the plug-in, and executes the plug-in withinthe framework of a limited functionality component (e.g., the limitedfunctionality component 330). It is appreciated that, in some examples,the plug-in manager may install the plug-in but not execute it. In theseexamples, the limited functionality component may execute the program,for example, after receiving a command implemented partially orcompletely by the plug-in. In this way, the functionality of the limitedfunctionality component may be extended in a convenient, but secure,manner.

FIG. 11 illustrates a notification system 1100 in accord with some ofexamples. As shown, the notification system 1100 includes medicaldevices 1102 and 1104, communication devices 1106 and 1108, a remoteserver 1110, a communication network 1112, and network connections 1114and 1116. The medical device 1102 exchanges information with thecommunication device 1106 via the network connection 1116. Similarly,the medical device 1104 exchanges information with the communicationdevices 1106 and 1108 via the network connections 1114 and 1126. In thisexample, the communication devices 1106 and 1108 exchange informationwith the remote server 1110 via the network 1112.

The network connections 1114, 1116, and 1126 may be implemented throughany one or combination of wireless communication standards and protocolsincluding, for example, BLUETOOTH, Wireless USB, ZigBee, and WirelessEthernet. The network 1112 may include any communication network throughwhich programmable devices may exchange information. In some examples,the network 1112 supports wireless network and/or wired connections. Forinstance, the network 1112 may support any of various networkingstandards such as GSM, CMDA, USB, BLUETOOTH, CAN, ZigBee, WirelessEthernet, and TCP/IP among others.

The medical devices 1102 and 1104 may include any medical devicedisclosed herein or a different medical device that includes a limitedfunctionality component. In one example illustrated by FIG. 11, themedical device 1102 is associated with and provides care to a patient1120 and the medical device 1104 is associated with and provides care toa patient 1118. In this example, the communication device 1106 isassociated with and provides information to a user 1122, and thecommunication device 1124 is associated with and provides information tothe patient 1118.

As illustrated in FIG. 11, a medical device may communicate with one ormore communication devices and a communication device may communicatewith one or more medical devices. In some examples, a singlecommunication device may communicate with only one medical device at atime (e.g., be paired with only a single medical device at a time) andbe disconnected or “unpaired” from a first medical device beforeconnecting to a second medical device. For example, such a communicationdevice may be paired over BLUETOOTH with a corresponding medical device.In some examples, the communication device may be configured tocommunicate with two or more medical devices without being disconnectedfrom either medical device during a transmission. For example, such acommunication device may be paired over BLUETOOTH with a plurality ofmedical devices using, e.g., BLUETOOTH multi-device convertibility.Coupling a single communication device with a plurality of medicaldevices may be advantageous where, for example, a care provider (e.g.the user 1122) monitors a plurality of patients.

In one example, the care provider may be a nurse in a hospital setting,and the patients 1118 and 1120 may both be ambulatory and engaged inrehabilitation regimens. In this situation, the nurse can monitor bothpatients' activities using a single communication device (e.g. a tabletcomputer) and can issue a reminder to either or both of the patients1118 and 1120 should their heart rate exceed a threshold value. Thisreminder may instruct the patients 1118 and 1120 to stop exercising. Inat least one example, this notification is initiated by the nurse viathe communication device 1106 and is displayed by the either or bothmedical devices 1102 and 1104. In another example, coupling a singlemedical device with a plurality of communication devices may beadvantageous where, for example, a patient (e.g. the patient 1118) and acare provider (e.g., the user 1122) both monitor the activity of thepatient 1118. In this situation, the care provider 1122 can monitor bothpatients' activities using a single communication device (e.g. a tabletcomputer) and can configure the notification system to issue anotification should any of the monitored patients' 1118 and 1120activities transgress preset thresholds and/or changes, trends, or has apattern in accordance with preset changes, trends, or patterns in theunderlying parameters. This example provides redundancy of monitoringactivities, thereby increasing the safety afforded to the patient 1118by the notification system 1100.

The processes disclosed herein each depict one particular sequence ofacts in a particular example. The acts included in these processes maybe performed by, or using, one or more computer systems speciallyconfigured as discussed herein. Some acts are optional and, as such, maybe omitted in accord with one or more examples. Additionally, the orderof acts can be altered, or other acts can be added, without departingfrom the scope of the systems and methods discussed herein. Furthermore,as discussed above, in at least one example, the acts are performed on aparticular, specially configured machine, namely a medical deviceconfigured according to the examples disclosed herein.

Having thus described several aspects of at least one example, it is tobe appreciated that various alterations, modifications, and improvementswill readily occur to those skilled in the art. For instance, examplesdisclosed herein may also be used in other contexts. Such alterations,modifications, and improvements are intended to be part of thisdisclosure, and are intended to be within the scope of the examplesdiscussed herein. Accordingly, the foregoing description and drawingsare by way of example only.

1-41. (canceled)
 42. A system comprising: a cardiac monitoring devicecomprising a cardiac monitoring device battery configured to supplypower to the cardiac monitoring device, a cardiac monitoring devicememory, a cardiac monitoring device network interface, a plurality ofelectrodes configured to acquire electrocardiogram (ECG) signals from apatient, and at least one processor coupled to the cardiac monitoringdevice battery, the cardiac monitoring device memory, the cardiacmonitoring device network interface, and the plurality of electrodes,and configured to implement a limited functionality interface configuredto not affect primary operations of the cardiac monitoring device,generate, as one of the primary operations of the cardiac monitoringdevice, ECG data from the ECG signals of the patient acquired via theplurality of electrodes, transmit the ECG data to a communication devicevia a wireless connection between the cardiac monitoring device and thecommunication device, receive, from the communication device via thelimited functionality interface, a limited functionality command toretrieve data from the cardiac monitoring device, and transmit the datafrom the cardiac monitoring device to the communication device via thelimited functionality interface and the wireless connection; and thecommunication device, wherein the communication device comprises acommunication device battery configured to provide power to thecommunication device, a communication device memory, a communicationinterface configured to communicate with the cardiac monitoring device,one or more network interfaces configured to communicate with a remoteserver, and one or more processors coupled to the communication devicebattery, the communication device memory, the communication interface,and the one or more network interfaces, and configured to establish thewireless connection between the communication device and the cardiacmonitoring device via the communication interface and the cardiacmonitoring device network interface, receive the ECG data via thewireless connection, transmit the ECG data to the remote server via theone or more network interfaces, transmit the limited functionalitycommand to the cardiac monitoring device via the limited functionalityinterface and the wireless connection, receive the data from the cardiacmonitoring device via the limited functionality interface and thewireless connection, and store the data from the cardiac monitoringdevice in the communication device memory.
 43. The system of claim 42,wherein the primary operations of the cardiac monitoring device compriseone or more of monitoring the patient for a predetermined patientcondition, providing information relating to the predetermined patientcondition, receiving user input relating to the predetermined patientcondition, determining a therapy for the patient on detecting thepredetermined patient condition, providing the therapy to the patientbased on the predetermined patient condition, or executing self-tests.44. The system of claim 42, wherein the limited functionality interfaceis further configured to: receive, from the communication device, one ormore limited functionality commands to monitor a patient parameter fortransgression of a threshold value; detect the transgression of thethreshold value by the patient parameter; and transmit a reportindicating the transgression of the threshold value to the communicationdevice in response to detection of the transgression.
 45. The system ofclaim 44, wherein the one or more processors are further configured to:transmit the one or more limited functionality commands to monitor thepatient parameter to the cardiac monitoring device via the limitedfunctionality interface; and receive the report from the cardiacmonitoring device.
 46. The system of claim 42, wherein the cardiacmonitoring device further comprises a user interface, wherein thecardiac monitoring device is further configured to monitor the patientin response to user action.
 47. The system of claim 42, wherein thecardiac monitoring device further comprises one or more of an acousticsensor, a tissue fluid sensor, or a pulse oximetry sensor.
 48. Thesystem of claim 42, wherein the communication interface comprises acellular network interface.
 49. The system of claim 42, wherein thewireless connection comprises one or more of a BLUETOOTH connection, awireless USB connection, or a ZigBee connection.
 50. A cardiacmonitoring device comprising: a cardiac monitoring device batteryconfigured to supply power to the cardiac monitoring device; a cardiacmonitoring device memory; a cardiac monitoring device network interface;a plurality of electrodes configured to acquire electrocardiogram (ECG)signals from a patient; and at least one processor coupled to thecardiac monitoring device battery, the cardiac monitoring device memory,the cardiac monitoring device network interface, and the plurality ofelectrodes, and configured to implement a limited functionalityinterface configured to not affect primary operations of the cardiacmonitoring device, generate, as one of the primary operations of thecardiac monitoring device, ECG data from the ECG signals of the patientacquired via the plurality of electrodes, transmit the ECG data to acommunication device via a wireless connection between the cardiacmonitoring device and the communication device, receive, from thecommunication device via the limited functionality interface, a limitedfunctionality command to retrieve data from the cardiac monitoringdevice, and transmit the data from the cardiac monitoring device to thecommunication device via the limited functionality interface and thewireless connection.
 51. The cardiac monitoring device of claim 50,wherein the primary operations comprise one or more of monitoring thepatient for a predetermined patient condition, providing informationrelating to the predetermined patient condition, receiving user inputrelating to the predetermined patient condition, determining a therapyfor the patient on detecting the predetermined patient condition,providing the therapy to the patient based on the predetermined patientcondition, or executing self-tests.
 52. The cardiac monitoring device ofclaim 50, wherein the limited functionality interface is furtherconfigured to: receive, from the communication device, one or morelimited functionality commands to monitor a patient parameter fortransgression of a threshold value; detect the transgression of thethreshold value by patient parameter; and transmit a report indicatingthe transgression of the threshold value to the communication device inresponse to detection of the transgression.
 53. The cardiac monitoringdevice of claim 50, further comprising a user interface, wherein thecardiac monitoring device is further configured to monitor the patientin response to user action.
 54. The cardiac monitoring device of claim50, wherein the cardiac monitoring device further comprises one or moreof an acoustic sensor, a tissue fluid sensor, or a pulse oximetrysensor.
 55. The cardiac monitoring device of claim 50, wherein thewireless connection comprises one or more of BLUETOOTH connection, awireless USB connection, or a ZigBee connection.
 56. A communicationdevice comprising: a communication device battery configured to providepower to the communication device; a communication device memory; acommunication interface; one or more network interfaces configured tocommunication with a remote server; and one or more processors coupledto the communication device battery, the communication device memory,the communication interface, and the one or more network interfaces, andconfigured to establish a wireless connection between the communicationdevice and a cardiac monitoring device via the communication interface,receive ECG data via the wireless connection, transmit the ECG data tothe remote server via the network interface the one or more networkinterfaces, transmit a limited functionality command to the cardiacmonitoring device via a limited functionality interface and the wirelessconnection, the limited functional command being a request for data fromthe cardiac monitoring device, receive the data from the cardiacmonitoring device via the limited functionality interface and thewireless connection, and store the data from the cardiac monitoringdevice in the communication device memory.
 57. The communication deviceof claim 56, wherein the one or more processors are further configuredto: transmit one or more limited functionality commands to monitor apatient parameter for transgression of a threshold value to the cardiacmonitoring device via the limited functionality interface; and receive areport indicating the transgression of the threshold value by thepatient parameter from the cardiac monitoring device.
 58. Thecommunication device of claim 56, wherein the communication interfacecomprises a cellular network interface.
 59. The communication device ofclaim 56, wherein the wireless connection comprises one or more ofBLUETOOTH connection, a wireless USB connection, or a ZigBee connection.60. The communication device of claim 56, further comprising a userinterface, wherein the communication device is configured to displayinformation regarding one or more operations executed by thecommunication device via the user interface.
 61. The communicationdevice of claim 60, wherein the information regarding one or moreoperations comprises information regarding one or more of battery levelor wireless connection strength.